Scam Alert!! Don’t (always) Follow the Captcha

A new scam is making the rounds, and it’s much smarter than the old “send us your password” trick.

You click a link and land on a page that looks completely normal. Then a CAPTCHA pops up:

“Verify you’re human.”

But instead of asking you to click a box, it tells you to press Windows + R, paste something, and hit Enter.

Don’t.

That “verification” can actually be a command that downloads malware onto your computer. The scam is designed to make you install the malware yourself.

The trick is known as ClickFix, and cybersecurity researchers have been warning about its growing use.

The rule is simple:

A CAPTCHA should never ask you to run a command on your computer.

If a webpage tells you to open PowerShell, Terminal, Run, or paste something into your computer, close the page.

You’re not proving you’re human.

You’re doing exactly what the scammer wants.