Fake CAPTCHAs Trick Users Into Running Malicious Commands

Thousands of legitimate websites have been compromised, allowing attackers to display fake CAPTCHA prompts. Over 5,400 websites across more than 2,200 organizations worldwide have been affected in recent months. These sites, often belonging to small businesses, present users with a seemingly routine CAPTCHA. However, the prompts deceptively instruct users to open the Windows Run dialog and paste commands. This action can lead to the download and execution of malware. Security researchers emphasize that legitimate CAPTCHAs never require running computer commands. This technique, known as ClickFix, exploits user familiarity with CAPTCHAs to lower their guard. Attackers are using the test version of the BNB Smart Chain to store instructions, making the infrastructure more resilient and harder to shut down. A newer attack variant bypasses the fake CAPTCHA, using WebRTC to deliver malicious code directly through the browser without saving files. Experts advise users to never paste commands from websites, to be suspicious of unusual CAPTCHA instructions, and to maintain strong antivirus protection and updated systems. Website owners are urged to check their site integrity. The core defense remains recognizing that websites should not ask users to run commands to prove they are human. If such a request appears, the page should be closed immediately.