‘Prove you are not a robot’: how the Captcha scam captures your computer

A fake CAPTCHA scam called ClickFix tricks people into installing malicious software themselves by asking them to press keyboard shortcuts. The tactic exploits how familiar CAPTCHA checks have become, making a suspicious request seem routine; a cybersecurity researcher describes it as a particularly widespread way to spread malware.

The scam may first copy malicious code to a computer’s clipboard after the user ticks a box, then ask them to press Windows key + R, paste with Ctrl + V and press Enter. Other versions claim a webpage has failed and offer similar instructions. The advice is to pause before following unexpected prompts, check that security software can block malicious sites, and contact your bank promptly if your computer is compromised.