You click "I'm not a robot" all the time. But new fake CAPTCHA scam can install malware on your computer
Most internet users have clicked an "I'm not a robot" box hundreds of times. Cybersecurity experts warn scammers are now using fake CAPTCHA prompts to trick people into installing malware on their devices.
Federal regulators and identity theft experts say the scam starts with a screen looking like a legitimate CAPTCHA verification test. Instead of asking users to identify images or check a box, it instructs them to enter a series of keyboard commands.
How the scam works
The scam often begins on a website that appears legitimate. After selecting the CAPTCHA check box, users are told to press a sequence of keys such as Windows+R, followed by Ctrl+V and Enter.
Experts say those instructions can paste and install a malicious command that installs malware on the device. Unlike traditional hacking attempts, the scam relies on convincing people to infect their own computers.
What scammers can steal
Once installed, the malware can capture sensitive information entered on the device, including usernames, passwords, banking credentials and email logins.
"Any of the accounts that you are logging into as you conduct your business, now it has enough information in a lot of circumstances to pretend to be you," Eva Velasquez, CEO of the Identity Theft Resource Center, said.
Velasquez said some malware functions as an "info stealer," recording keystrokes and capturing credentials as users log in to accounts.
"It's an info stealer that is tracking all of the keystrokes that you are making. Which may not matter if you're just Googling how to grow tomatoes or watching YouTube, but if you are logging into different accounts, it's capturing that, too," Velasquez said.
Red flags to watch for
Experts say legitimate CAPTCHA systems should never ask users to:
- Run commands on a device
- Open the Windows Run dialog
- Paste text into a command box
- Download files
- Install software
- Enable special permissions
Other warning signs include CAPTCHAs appearing unexpectedly, suspicious website addresses and unusually complicated instructions.
What to do if you fall for it
If you think you completed a fake CAPTCHA, experts recommend acting quickly. Disconnect the device from the internet, run a full antivirus or anti-malware scan and delete any suspicious downloads.
Users should also clear their browser cache, review browser extensions, change important passwords from a different trusted device and enable two-factor authentication.
The bottom line
Consumer experts say the rule is simple: A real CAPTCHA should only verify that you are human. It should never ask you to open a program, paste commands, download files or run software on your computer.
If a CAPTCHA asks you to do any of those things, close the page immediately. The few seconds it takes to stop and think could help prevent malware infections, stolen passwords and identity theft.
You can watch the full episode of the In Your Corner podcast and find new episodes posted Wednesdays on the CBS Philadelphia YouTube channel.
Looking for help with a consumer issue? Click here to submit your complaint to In Your Corner.