LEGALAUDIT

Scam Radar

How can you recognize Fake CAPTCHA prompts trick users into running malware on their PCs?

Published

Listen to the episode

TLDR

The NCSC Switzerland warns of a sharp rise in compromised legitimate websites (over 100,000 globally) that display fake CAPTCHA verification pop ups. Instead of a normal "I am not a robot" check, users are shown instructions to copy and...

How it works

The NCSC Switzerland warns of a sharp rise in compromised legitimate websites (over 100,000 globally) that display fake CAPTCHA verification pop ups. Instead of a normal "I am not a robot" check, users are shown instructions to copy and...

Red flags

  • : A CAPTCHA asks you to press Win+R, open PowerShell, or paste a command — real CAPTCHAs never require this. The verification box appears on a site that has nothing to do with security (news, blogs, shops). Instructions use urgency or technical jargon ("verify you are human", "update browser cache") to push you past doubt

What to do

  1. 1: Never copy paste or run commands suggested by a web page, chat, or pop up. Keep your browser, OS, and antivirus updated and enable real time web protection. If you already ran the command: disconnect from the network, change all passwords from a clean device, and run a full malware scan or seek profess

Source

ncsc-switzerland

Source reviewed by Mythos Forensic Team

https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2026/clickfix.html

FAQ

Is Fake CAPTCHA prompts trick users into running malware on their PCs a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

: A CAPTCHA asks you to press Win+R, open PowerShell, or paste a command — real CAPTCHAs never require this. The verification box appears on a site that has nothing to do with security (news, blogs, shops). Instructions use urgency or technical jargon ("verify you are human", "update browser cache") to push you past doubt

What should I do first?

: Never copy paste or run commands suggested by a web page, chat, or pop up. Keep your browser, OS, and antivirus updated and enable real time web protection. If you already ran the command: disconnect from the network, change all passwords from a clean device, and run a full malware scan or seek profess

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.