The CAPTCHA That Installs Malware

You have clicked "I'm not a robot" boxes a thousand times without thinking. Scammers built a fake one. 

A new CAPTCHA threat has emerged as the latest scam we must address in our continued efforts to stay safe online. It looks like the verification check you see every day, but instead of picking traffick lights, it asks you to press a few keys. Those keystrokes quietly install software that steals your saved passwords. Scammers call it "ClickFix," and it works on Windows and Mac. 

Here's a start-to-finish view of what this threat looks like so you can safeguard against it.

Step 1: You open a normal-looking page.

You click on a search result, an email link, an ad, or a real site that has been hacked. Nothing feels wrong yet.

Step 2: A verification box appears.

You're redirected to a CAPTCHA verification. It looks familiar, except for the red part. A real CAPTCHA check never asks you to press keys.

Step 3: A command is copied without your knowledge.

The site loads a hidden command onto your clipboard in the background. You didn't copy anything, but the command is now sitting on your clipboard. 

Step 4: You press the three keys.

Step 5: The box hides the actual command your system is running.

Padded with a blank space so that you'll only see a harmless code, the real command keeps going offscreen and Antivirus may not step in. 

Step 6: A password stealer goes to work. 

The command now running on your computer scrapes your saved passwords, your credit card and address auto-fills, and your "stay signed in" files, which let someone open your email without your password or login code. 

Warning Signs to be Wary Of

• A human-verification check that asks you to press keys or open a program
• A pop-up that tells you to press "Allow" to continue
• A security check on a site that did not have one before
• An error or crash screen that offers a command to fix it

Sources:

• Federal Trade Commission, "How to spot a CAPTCHA scam" (June 8, 2026)

  https://consumer.ftc.gov/consumer-alerts/2026/06/how-spot-captcha-scam

• Microsoft Security, "Think before you Click(Fix)"

  https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/