What Happened
The FTC is getting reports about a new phishing scam that looks almost identical to the CAPTCHA requests people see all the time online. Real CAPTCHAs give you image or text-based tasks—type letters and numbers, match pictures of fire hydrants, that kind of thing. But the fake CAPTCHA scams are different. They tell you to run keyboard commands on your computer, like "Windows + R," then "Ctrl + V," then "Enter."
Once you run those commands, you've just pasted and executed hidden malware that scammers left for you. And now they have access to your email login data, mobile banking credentials, saved passwords, cryptocurrency wallets, and anything else they can grab from your browser before you notice something's wrong.
Why This Matters
CAPTCHAs exist to prove you're human. Most people have learned not to trust unexpected pop-ups. But a CAPTCHA screen? That looks official. That looks like normal internet. And when the scammer's message says "security verification," it doesn't feel like a trap—it feels like routine web maintenance.
The genius of the scam is that it exploits muscle memory. You're used to clicking through CAPTCHAs without really thinking about it. So a CAPTCHA that asks for a tiny bit more interaction—just type a few commands—doesn't trigger the alarm in your brain that it should.
The Dumb Part With The Fake Proof
The dumb part is that legitimate websites and services have spent decades teaching people that CAPTCHAs are safe, boring security checks that prove you're human. That trust is now a vulnerability. Real CAPTCHAs never ask you to run commands on your device. Ever. But because people have been trained not to question them, a scammer can just copy the aesthetic and add one dangerous step.
If a CAPTCHA asks you to paste a command or run software, that's not a CAPTCHA. That's a command injection attack wearing a CAPTCHA costume.
How to Protect Yourself
The FTC says to remember: real CAPTCHAs never ask you to run commands on your computer. If you see a CAPTCHA that does, or if you notice something downloading after you respond to one, act quickly:
- Disconnect from the internet immediately. This stops scammers from using your account access.
- Run a security scan on your device to remove the malware.
- Change your passwords and enable two-factor authentication on important accounts—using a different, clean device.
- Report it to the FTC at ReportFraud.ftc.gov.
The Bottom Line
The real stupid shit is that we've created a world where the most common, trusted-looking security check on the internet is now a viable vector for malware delivery. When a CAPTCHA that looks like a CAPTCHA can steal your banking credentials, we have a fundamental trust problem. The scammer wins because they borrowed an existing expectation. The internet loses because another everyday thing is now something to be paranoid about.
Sources
FTC Consumer Alert: How to spot a CAPTCHA scam
FTC: Malware — How to Protect Against, Detect, and Remove It