Author: Jeff Weeks, Senior Vice President and Chief Information Security Officer

Key Takeaways

• Fake CAPTCHA scams can trick you into installing malware. If a CAPTCHA asks you to press Windows + R, open the Run box or Terminal, or paste and run a command, close the tab.
• Infostealers can take more than passwords. Malware used in these attacks may steal session cookies, account tokens, browser data and other sensitive information.
• If you followed the instructions, act quickly. Disconnect the affected computer, change important passwords from a trusted device, sign out of active sessions and have the computer checked for malware.

I’ve been in the cybersecurity field a long time, and every so often a scam comes along that earns a grudging bit of respect for how clever it is. This is one of them.

You’re on a website. Maybe a recipe blog, a news story or a page that turned up when you searched for a free copy of some form. A familiar box pops up: “Verify you are human.” You’ve clicked a thousand of these. You click this one, too.

Then it gives you something new to do. To finish verifying, press the Windows key and R. Then press Ctrl and V. Then press Enter. (Mac users get a version that asks them to open Terminal and paste.) It looks official. It may even carry a logo you recognize. It’s three keystrokes. What’s the harm?

The harm is that you may have just run a command designed to install malware on your computer. Security researchers call this trick “ClickFix,” a type of fake CAPTCHA scam that tricks you into running a malicious command on your computer. And it has spread far enough that the Federal Trade Commission issued a consumer warning about CAPTCHA scams in June 2026. It hasn’t slowed down since.

In September 2026, Arctic Wolf researchers reported a fake-CAPTCHA campaign with interaction activity recorded in 32 countries, although the researchers cautioned that the data did not confirm that every interaction resulted in an infection.

How a Fake CAPTCHA Installs Malware

When you clicked that box, the page quietly copied a command to your clipboard. You never saw it. Windows + R opened the Run window, Ctrl + V pasted the hidden command, and Enter ran it.

You may never see a normal download button or browser warning. The command can retrieve and run malicious software in the background. As far as your computer is concerned, you typed that command yourself, on purpose.

Because the user launches the command through a legitimate Windows tool, the activity may initially look less suspicious than opening an unfamiliar attachment. Modern online security tools may still detect or block parts of the attack, but no control catches every variation.

These fake CAPTCHA campaigns frequently attempt to install information-stealing malware, or an infostealer. Depending on the malware and what is stored on the device, an infostealer may collect saved passwords, browser data, account tokens, session cookies, autofill information and cryptocurrency-wallet data.

Why Fake CAPTCHA Scams Steal Session Cookies

A session cookie is what keeps you logged in so you don’t have to type your password and a code every time you open a site. Think of it like a coat-check ticket. Whoever is holding the ticket gets the coat, and the attendant doesn’t ask for ID.

If a criminal walks off with that cookie, they can sometimes step right into your account as you, without ever needing your password or your text-message code. That is why infostealers are dangerous even for people who have done everything right. Multi-factor authentication is still one of the best things you can turn on. It just can’t protect a door that’s already been opened and propped.

The other unsettling part: nothing looks wrong. There’s no skull on the screen and no ransom note. The computer runs fine. Many people find out days later, when their email gets taken over or a transaction shows up that they didn’t make.

How to Spot a Fake CAPTCHA

A real CAPTCHA asks you to check a box, pick out the pictures with buses in them or type some wobbly letters. Everything happens inside the web page.

A legitimate CAPTCHA will not require you to:

• Press Windows + R or open the Run box
• Open Terminal, PowerShell or Command Prompt
• Paste something and press Enter to “verify” or “fix” a problem

If a page asks you to do any of those things, close the tab. Not the pop-up, the whole tab. The same goes for pop-ups claiming your browser is broken and offering a quick command to fix it. That’s the same trick in a different costume.

How to Protect Yourself From Malware and Account Theft

• Log out of online banking when you’re done. Signing out ends that session, so a stolen cookie is worth a lot less. Skip “remember me” on shared or family computers.
• Think twice about letting your browser store your banking password. A dedicated password manager is a better home for the keys to your most important accounts.
• Turn on account alerts. Check the alert settings in your online and mobile banking for new logins, new payees and transfers. Alerts won’t stop a thief, but they can shrink the time between when something happens and when you know about it.
• Use passkeys where they’re offered. They’re tied to your device and there’s nothing to type or paste, which takes a lot of the fun out of this kind of trick.
• Have the talk at home. Teenagers hunting for free game mods, free movies or cracked software land on exactly the kinds of sites that serve these fake checks.

What to Do If You Fell for a Fake CAPTCHA

Don’t panic but do move quickly.

1. Disconnect that computer from the internet. Turn off Wi-Fi or unplug the cable.
2. From a different device you trust, like your phone, change your email password first, then your banking and other financial passwords. Email is first because it’s the reset key to almost everything else.
3. Use “sign out of all devices” wherever a site offers it. That kills any stolen sessions.
4. Call your bank using the number on the back of your card or on the official website, never a number from a pop-up or a search ad.
5. Have the computer checked or cleaned for malware by someone reputable before you use it for anything sensitive again.
6. Report it at ReportFraud.ftc.gov and ic3.gov. It helps get these sites taken down.

The Bottom Line

This scam works because it borrows trust we’ve built up over years of clicking those little boxes without a second thought. Criminals love a habit. So, here’s a new one to replace it: a robot check asks you to prove something on the page. It never asks you to do something to your computer.

About the Author

Jeff has been with FNBO for more than 27 years and is currently the Senior Vice President and Chief Information Security Officer. The executive leadership and oversight provided by Jeff in the development, management, and execution of information security for FNBO enables the company’s ability to posture and protect private, personal information, and assets of the company’s clients, employees, and business partners.