Protect your tech
Fake Captchas that install malware
WATCH OUT FOR...
Scams and threats to avoid, plus new security tools
What’s the threat?
Cybercriminals are posting fake Captchas that trick you into installing malware on your computer. Rather than asking you to tick a box or identify parts of a photo, the Captchas say you need to paste a command or file into command-line tools in Linux, macOS or Windows.
Earlier forms of this scam, spotted in May and called ClickFix, gave written instructions only. But a more recent version, seen by UK firm Push Security, adds a video tutorial ( 1 in our screenshot) explaining what you need to do. If you follow the instructions you install the malware Lumma Stealer, which steals sensitive data like passwords and cookies. The scam has a countdown timer to add urgency 2 and claims that a certain number of people “in your region have verified successfully in the last hour” 3 . It also uses a similar logo to Cloudflare 4 , a reputable company whose security services include legitimate Captchas.