• Source:JND
Add as a preferred

That familiar “I’m not a robot” checkbox may not always be as safe as it seems. Cybersecurity experts warn that attackers are now using fake CAPTCHA pages to trick users into installing malware.

From Security Tool to Scam

A genuine CAPTCHA — short for “Completely Automated Public Turing test to tell Computers and Humans Apart” — is designed to confirm that a real person, not a bot, is accessing a site. These tests often involve selecting images, typing distorted text, or ticking a simple box.

ALSO READ: Tecno Spark Go 5G Launches In India Claimed As Country’s Thinnest 5G Phone Under ₹10,000

However, cybersecurity specialists explain that attackers often spread fake CAPTCHAs through hacked websites, malicious online ads, phishing emails, or even fake versions of popular sites. These fraudulent pages can convince visitors to turn on browser notifications or download harmful files under the pretense of verification.

How the Attack Works

Investigations by CloudSEK’s Threat Research and Information Analytics Division (TRIAD) revealed that some of these scams are being used to deliver Lumma Stealer malware to Windows systems. In these attacks, phishing sites — sometimes hosted on Content Delivery Networks to appear more legitimate — display what looks like a Google CAPTCHA page.

Instead of a real challenge, users are instructed to open the Windows Run dialog, paste a provided code, and press Enter. This process triggers a hidden script that executes a base64-encoded PowerShell command, which then downloads the malware from a remote server.

Cyber researchers emphasize that the act of clicking a fake CAPTCHA isn’t the main threat. The real danger begins when victims follow on-screen instructions, such as pasting commands into a terminal or downloading verification files, which can give hackers direct access to their systems.

Spotting the Fakes

According to security experts, authentic CAPTCHAs are always built into trusted websites and involve only simple on-screen actions. Fake ones may show up as pop-ups, request notification permissions, prompt downloads, or ask for personal or payment details. They recommend checking site addresses for spelling errors, odd symbols, or suspicious domains.

ALSO READ: Apple Could Launch A WALL-E-Like Tabletop Robot Companion By 2027

What to Do If You Encounter One

If you suspect a CAPTCHA is fake:

  • Close the page immediately
  • Disconnect your internet connection
  • Run a full antivirus scan
  • Clear browser cache, cookies, and remove suspicious extensions
  • Change important account passwords from a secure device
  • Delete any files you downloaded without opening them

Cybersecurity professionals also point out that industries such as e-commerce and online gaming face higher risks because attackers often target platforms with financial or account data. They stress the importance of avoiding unknown links and verifying URLs before clicking, warning that one careless action can result in both financial loss and privacy breaches.