Fake CAPTCHA pages are prompting computer users to run commands that can install malware, a tactic documented by security researchers and U.S. agencies that can expose credentials and financial accounts.
New Zealand’s National Cyber Security Centre (NCSC) said in a Sept. 2 alert that compromised websites, including WordPress sites, can host ClickFix prompts disguised as CAPTCHA or Cloudflare verification. The pages try to persuade visitors to run code on their own devices.
In a Windows campaign analyzed by Kaspersky, clicking a fake verification button copied a PowerShell command to the clipboard. The page then instructed users to open the Run box, paste the command and press Enter. Those steps executed the code; clicking the button alone did not complete the sequence.
The potential stolen data varies by campaign. Kaspersky found that one campaign’s Lumma Stealer sought cryptocurrency-wallet files, browser cookies, saved credentials and password-manager archives; the campaign also distributed the Amadey Trojan. The Federal Trade Commission (FTC) warned that malware installed through fake CAPTCHA instructions could expose email logins and mobile banking credentials. “Real CAPTCHAs won’t ask you to run commands on your device,” the agency said.
A joint advisory from the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), U.S. Department of Health and Human Services (HHS) and Multi-State Information Sharing and Analysis Center (MS-ISAC) says the FBI observed Interlock actors using ClickFix in some instances to get users to execute encoded PowerShell commands. Separately, the advisory says investigators observed credential-stealer and keylogger downloads after attackers established remote control of a compromised system. The advisory does not present those observations as one infection sequence.
Kaspersky reported that from Sept. 22 to Oct. 14, 2024, more than 140,000 users encountered ad scripts in one campaign and more than 20,000 were redirected to infected sites. Some of those sites displayed fake CAPTCHA or software-update prompts. In a June 2026 alert, the FTC said it was receiving reports about the scam but did not give a count of reports.
