Fake CAPTCHA Scam Installs Malware via Keyboard Commands

• •The fake CAPTCHA scam tricks users into executing malware via keyboard commands.
• •Victims risk exposure of sensitive information, including passwords and financial data.
• •Immediate disconnection from the internet and password changes are critical steps for victims.

In June 2026, the FTC issued a consumer alert regarding a fake CAPTCHA scam that tricks users into executing malware on their devices. The scam presents a verification box mimicking legitimate CAPTCHA screens, asking users to perform specific keyboard commands. When users comply, the malware is executed, allowing attackers to harvest sensitive information like passwords and financial credentials. This attack exploits user trust rather than software vulnerabilities, making it particularly insidious. Victims are advised to disconnect from the internet immediately, change their passwords, and run antivirus scans. The scam targets anyone who encounters these fake CAPTCHA prompts, potentially affecting millions of users. Awareness and education on recognizing these scams are crucial for prevention.