Most of us have seen CAPTCHA checks online.
They usually ask us to tick a box, select traffic lights, identify buses, or type a few letters to prove that we are human. Because these checks are so common, many people complete them without thinking twice.

Cybercriminals are now taking advantage of that trust.
A growing cyberattack technique, often called fake CAPTCHA, CAPTCHA scam, or ClickFix, is tricking people into running malicious commands on their own computers. These fake pages may look like a normal “verify you are human” screen, but instead of asking you to solve a real CAPTCHA challenge, they tell you to press keyboard shortcuts such as Windows + R, Ctrl + V, and Enter.

A real CAPTCHA checks whether you are human. A fake CAPTCHA tries to make you install malware.

WHAT IS A FAKE CAPTCHA ATTACK?
A fake CAPTCHA attack is a scam where cybercriminals create a fake verification page that looks like a trusted security check. The goal is to make the victim believe they are completing a normal website security step. In reality, the instructions are designed to make the user run a hidden command on their computer.

HOW THE ATTACK WORKS

1. You visit a website, click an advert, open a suspicious link, or land on a compromised webpage.
2. A fake verification screen appears.
3. The page gives unusual keyboard instructions.
4. A hidden command runs on your computer.
5. Malware may then be downloaded and installed.
6. The attacker may steal passwords, browser cookies, banking details, business files, or gain remote access.

REAL CAPTCHA VS FAKE CAPTCHA
Real CAPTCHA and reCAPTCHA tools help websites block bots, reduce spam, and protect online forms.

Fake CAPTCHA pages abuse people’s trust and may ask users to open Run, PowerShell, Command Prompt, or Terminal and execute commands.

WARNING SIGNS
– Press Windows + R
– Open Run, PowerShell, Command Prompt, or Terminal
– Paste a command
– Download a file to prove you are human
– Disable security protections

If a CAPTCHA asks you to run a command, it is not a CAPTCHA — it is a trap.

THE BUSINESS SIDE: REAL reCAPTCHA STILL MATTERS
Legitimate CAPTCHA tools help protect websites, forms, CRMs, and marketing systems from spam, bots, and fake submissions. Businesses should review their public forms and ensure appropriate bot protection is in place.

FINAL THOUGHTS
CAPTCHAs are meant to protect websites from bots. But cybercriminals are now using fake CAPTCHAs to trick real people.

Stay alert. Think before you click. Stop before you paste. And never run commands from a website you do not fully trust.

CyberatiDigital — Securing Your World, Digitally.