New CAPTCHA Scam Triggers Wallet Drains

A simple click box that once just proved you were human has become a doorway for hackers to hijack your computer.

Quick Take

Scammers now use fake CAPTCHA pop-ups to trick people into running hidden malware on their own devices.
The Federal Trade Commission (FTC) warns the scam asks victims to press key combos like Windows plus R, then Ctrl plus V, then Enter.
Following those steps secretly copies and runs malicious code that steals passwords, banking logins, and crypto wallet data.
Security experts, universities, and news outlets across the country are all reporting the same attack pattern.

A Familiar Security Check Turned Into a Trap

Most people barely notice CAPTCHA boxes anymore. They click “I’m not a robot,” maybe pick out a few crosswalks, and move on. That familiarity is exactly what criminals are exploiting now. The Federal Trade Commission says a growing scam disguises itself as a normal CAPTCHA screen, then tricks users into typing commands that let hackers slip malware onto their own machines.

The scam works because it borrows a trusted symbol. A CAPTCHA feels routine, almost boring, so people don’t stop to question it. That’s the whole point. Criminals count on muscle memory and mild annoyance to override caution, turning a two-second habit into the moment your device gets compromised without you ever clicking a suspicious link or downloading a visible file.

How the Fake Verification Actually Steals Your Information

Instead of a normal checkbox, the fake page tells users to press Windows plus R, then Ctrl plus V, then Enter, often under the guise of “security verification”. Those keystrokes open a Windows command window and paste code that was secretly copied to the clipboard the moment the page loaded. Hitting Enter runs it instantly, no download prompt or warning required.

Once triggered, the hidden program acts as what security researchers call an infostealer. Trend Micro’s research team has tracked these attacks harvesting saved browser passwords, email logins, and mobile banking credentials from infected devices. Cybernews reported a related version tricking Windows users into running a malicious script that specifically targets cryptocurrency wallets and drains funds directly.

Roseville’s city government, echoing the FTC’s alert, describes the bait plainly: a website visit is interrupted by what looks like an ordinary human-verification challenge. Nothing about the page screams danger. That’s the design. Duke University’s security office notes the same malware can also grab saved cookies and other personal files stored on the device, expanding the damage well past a single stolen password.

Spotting the Difference Between Real and Fake Verification

Malwarebytes offers the clearest test: a real CAPTCHA only asks you to check a box or solve a small puzzle. It never asks you to open a run command, paste anything, or press Enter to “verify” you’re human. If a verification page demands keyboard shortcuts instead of a simple click, that’s the red flag to walk away immediately.

The University of York’s information technology security team adds a second warning sign worth remembering. Genuine CAPTCHAs never require installing software or running system commands to prove anything. If a prompt appears out of nowhere, especially on a site you weren’t actively logging into, the safest move is closing the tab, not troubleshooting the “error.”

If you already followed the fake instructions, act fast rather than assume nothing happened. Malwarebytes recommends disconnecting from the internet, running a full antivirus scan, and changing passwords for sensitive accounts like email and banking right away. Waiting gives criminals more time inside your accounts, and infostealer malware often works quietly, without any obvious sign it’s there.

This scam spreads because it hijacks trust in something people were trained to accept without thinking. That’s a lesson worth keeping in mind well beyond CAPTCHAs. Any prompt that suddenly asks for keyboard commands instead of a simple click deserves suspicion, no matter how official the page looks or how routine the request feels.