CAPTCHA scams - how a fake "I am not a robot" page installs malware

You click a link. A page appears saying Verify you are human. You have seen a thousand of these, so you barely read it — and that is exactly what it is counting on.

Quick answer

A fake CAPTCHA page is one that asks you to do something on your computer instead of something in the browser. Real verification is a task inside the page: pick the traffic lights, type the wobbly letters, tick a box. A fake one gives you keyboard instructions.

The FTC's consumer alert from 8 June 2026 describes the sequence: the page tells you to type "Windows + R", then "Ctrl + V", then "Enter". Its warning is one line long, and it is the only rule you need:

Real CAPTCHAs won't ask you to run commands on your device.

Security researchers call the technique ClickFix.

How the trick works

The clever part is not the malware. It is the clipboard.

1. The page loads and copies a command to your clipboard, silently. Web pages can write to the clipboard, and nothing visible happens.
2. You are given three keystrokes, presented as verification steps:
   • Windows + R — this opens the Run dialog, a box that executes commands
   • Ctrl + V — this pastes the command the page put there
   • Enter — this runs it
3. The command downloads and runs the real payload, often a long Base64-encoded PowerShell instruction so that nothing readable appears on screen.
4. The page thanks you and sends you somewhere ordinary. Nothing looks broken.

You never saw a download prompt, never approved an installer, and never clicked through a security warning — because you performed the installation manually. That is the design. The steps are chosen precisely to route around the protections that would otherwise stop a file.

What gets installed

Usually an infostealer — malware whose whole job is to copy credentials and leave. The FTC's description of the consequence: attackers can "quickly steal your email account login data, mobile banking credentials, or any other information they can get access to."

A typical haul includes saved browser passwords, session cookies, autofill data, and cryptocurrency wallet files. The session cookies matter more than most people realise, because a stolen session can be replayed without a password or a two-factor code. Infostealer malware covers that mechanism in full.

The same lure has also been used for more than credential theft. In July 2025, the FBI, CISA, the Department of Health and Human Services and the MS-ISAC published a joint advisory on Interlock ransomware which documented actors using the ClickFix technique — prompting users to "open the Windows Run window, paste the clipboard contents, and then execute a malicious Base64-encoded PowerShell process."

Where you meet one

Rarely on a site that looks dangerous. That is the point.

• A compromised ordinary website. Legitimate sites get injected with the script; the page you were reading is real, the overlay is not.
• A malicious advert, including ones served through legitimate ad networks.
• A link in an email, text or direct message.
• A fake fix. "This video cannot be played — run this to install the codec." "This document is corrupted — paste this to repair it."
• A fake meeting or driver update page, imitating a well-known product.

The disguise varies. The instruction never does.

Real versus fake, side by side

What to do if you followed the instructions

The FTC's guidance, in order, with the reasoning:

1. Disconnect from the internet. Turn off wifi or unplug the cable. This cuts the malware off before it can upload what it has collected, and stops it fetching more.
2. Run a full security scan with reputable software to remove the malware. On Windows, Microsoft Defender's offline scan runs before the operating system fully loads, which catches things a normal scan misses.
3. Change your passwords from a different device. This is the step people get wrong. Passwords changed on a still-infected machine are captured again immediately. Use your phone, or another computer.
4. Turn on two-factor authentication, again from the clean device, on email first and then anything financial.
5. Sign out of all sessions on every important account. A password change alone may leave a stolen session cookie working.
6. Watch your bank and card accounts for small unfamiliar transactions, which often precede larger ones.
7. Report it at ReportFraud.ftc.gov, or your country's equivalent.

If you are not confident the device is clean, resetting it and restoring from a backup made before the incident is the reliable option. The NCSC publishes plain-language malware removal guidance for both outcomes.

How to avoid it entirely

• Learn the one rule. Verification never leaves the browser.
• Never paste a command you did not personally copy. Not into Run, not into PowerShell, not into Terminal.
• Be suspicious of any "fix" that is a command. Legitimate software is installed by downloading it from the vendor, not by typing instructions from a web page.
• Use an ad blocker or a browser with strong protection. Malicious adverts are a main delivery route.
• Keep the browser and operating system updated, and leave Microsoft Defender, Gatekeeper or Play Protect switched on.
• Slow down on verification screens. Two seconds of reading defeats the entire attack.

If you clicked a link and are not sure what happened next, I clicked a phishing link walks through the response for each possible outcome. For catching the message that carried you there, how to identify a phishing email covers the four checks.

Key takeaways

• A real CAPTCHA is a puzzle in the page. A fake one gives you keyboard instructions.
• The page has already put a command on your clipboard before you press paste.
• The payload is usually an infostealer after saved passwords and session cookies.
• The FTC alerted consumers to this in June 2026; ransomware crews have used the same lure since at least 2025.
• If you ran it: disconnect, scan, then change passwords from a different device.