NEWYou can now listen to Fox News articles!
You land on the real website of a local business and a CAPTCHA appears. It looks routine until the page tells you to open Windows Run and paste a command. That should stop you cold.
Security researchers say thousands of legitimate small-business websites have been compromised to spread this malware trap. Here’s what to know before a familiar website catches you off guard.
NEW! Join our upcoming CyberGuy LIVE class: Get Better Health Care With AI
In this free live online class, Kurt “CyberGuy” Knutsson will show you five practical ways AI can help you take a more active role in your health care. You’ll learn how to organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare questions for your next doctor’s visit. No technical experience is needed.
Register for free now at CyberGuyLive.com
FAKE PATIENT PORTAL SCAM CAN STEAL YOUR LOGIN AND INFECT YOUR PC
A routine visit to a legitimate website can turn risky if a fake CAPTCHA tricks you into running commands on your computer. (Kurt “CyberGuy” Knutsson)
More than 5,400 websites have been compromised
This campaign is much bigger than a handful of infected pages. Netskope Threat Labs says it identified more than 5,400 compromised websites across more than 2,200 organizations worldwide over the past few months.
The sites have little in common beyond many belonging to small businesses. Researchers found clinics, plumbing companies, online stores and other businesses among the victims.
Where Netskope examined individual sites, they most often ran WordPress and sometimes PrestaShop. Researchers still do not know how attackers initially compromised them.
That is important because you could visit the legitimate website of a business you recognize and still encounter a malicious prompt.
Netskope says several hundred compromised sites can be active on a given day. It has recently seen more than 300 sites contacting the malicious infrastructure each weekday.
How the fake CAPTCHA malware trick works
The attack starts with malicious code hidden inside a compromised website. When you visit the site, that code can load another script. Then the page may blur and show what looks like an ordinary CAPTCHA.
Instead of simply asking you to prove you are human, the page tells you to open the Windows Run dialog and paste a command. That command can download and launch the attacker’s malware.
Here is the warning sign I want you to remember: A legitimate CAPTCHA should never tell you to open Windows Run or paste a command into your computer.
We have seen fake CAPTCHA scams use this same trick before. The page looks familiar, so you may assume the instructions are part of a normal security check. They are not. The criminal is trying to get you to launch the attack yourself.
CLICKLOCK MAC MALWARE LOCKS APPS UNTIL YOU GIVE IN
Researchers found compromised websites using fake verification prompts that tell Windows users to open the Windows Run dialog and paste a command that can launch malware. (Netskope)
Why ClickFix can fool careful people
This technique is known as ClickFix. The clever part has less to do with some exotic computer hack and more to do with psychology.
You are already used to CAPTCHAs. Websites ask you to click a box or prove you are human all the time. So, when a convincing verification screen appears on a legitimate website, your guard may be down. Then the instructions make the dangerous action look like one more step in the verification process.
Cybercriminals have used similar ClickFix tricks with fake Windows update screens. The appearance changes, but the warning remains the same. A webpage should not be telling you to run computer commands.
Why hackers are hiding part of the attack on a blockchain
This is where the campaign gets more unusual. The attackers are using the BNB Smart Chain test network to store instructions used by the compromised websites.
You do not need to understand cryptocurrency to understand why criminals like this setup. Normally, attackers might keep malicious code on a regular web server. Once investigators find that server, a hosting provider may be able to shut it down.
A blockchain works differently. In this campaign, the attackers store code inside something called a smart contract. Think of it as a place where the hacked websites can check for their next set of instructions.
Netskope says the attackers are using the test version of BNB Smart Chain. Developers normally use this network to experiment without spending real cryptocurrency.
That gives the criminals inexpensive infrastructure that can also be harder to take down through traditional methods. There is another advantage.
The attacker can change what the smart contract delivers. The compromised websites can then pick up those new instructions without criminals having to modify every hacked site individually. That helps explain why this infrastructure is so useful to them.
Netskope researchers say attackers are also abusing WebRTC to create a direct connection from a victim’s browser to an attacker-controlled server and deliver additional malicious code. (Kurt “CyberGuy” Knutsson)
The campaign is already changing tactics
Netskope also found a newer version of the attack that skips the fake CAPTCHA. This version uses technology called WebRTC. Your browser normally uses WebRTC for things such as video calls and real-time communications. The attackers found another use for it.
Their code can create an encrypted data connection with the attacker and receive additional malicious code through the browser. Netskope says the code can then run without first being saved as a traditional file on the computer.
For you, the technical details are less important than the larger point. The criminals can change how the attack works while continuing to use the same network of compromised websites.
6 ways to protect yourself from fake CAPTCHA malware
A few simple habits can help you avoid handing control of your computer to an attacker.
1) Never paste computer commands from a website
If a website tells you to open Windows Run, PowerShell or Command Prompt, stop. Do not paste anything it gives you. Close the page instead.
2) Be suspicious of unusual CAPTCHA instructions
A normal CAPTCHA may ask you to click a checkbox or identify pictures. It should not require you to change settings or run commands on your PC. If the instructions suddenly leave the browser, close the page.
3) Use strong antivirus protection
Strong antivirus protection can help detect malicious scripts and malware if something slips past you. Keep it updated and enable real-time protection. If you accidentally follow suspicious instructions, run a full system scan. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com
4) Keep Windows and your browser updated
Install security updates when they become available. However, update Windows through Windows Update. Update your browser through its built-in settings or official source. Do not trust an unexpected webpage that says you must download an update.
5) Take action if you already ran the command
If you followed the instructions from a suspicious CAPTCHA, disconnect the computer from the internet. Run a full antivirus scan. Then use another trusted device to change passwords for sensitive accounts you accessed on that computer. Start with your main email account. Also review active login sessions and enable multifactor authentication wherever you can.
6) Check your site if you run a small business
Website owners should take this campaign seriously too. Netskope recommends checking the integrity of your content management system files. Researchers found malicious code added to legitimate JavaScript files or hidden inside fake plugin directories. Keep WordPress, PrestaShop and any plugins you use updated. Remove plugins you no longer need. Keep in mind that Netskope has not identified how attackers initially broke into the websites in this campaign. Those steps are good security practices, but researchers have not tied a specific WordPress or PrestaShop vulnerability to these compromises.
Kurt’s key takeaways
What gets me about this attack is how ordinary everything can look at first. You could be visiting the real website of a neighborhood business you have used before. Then a familiar CAPTCHA appears. That sense of trust is exactly what can make the next instruction dangerous. The blockchain technology behind the campaign makes life harder for security teams trying to shut it down. For the rest of us, though, the best defense is refreshingly simple. A website should never need you to open Windows Run or paste a command to prove you are human. If you see that request, close the page. That one warning sign could save you from installing malware yourself.
Would you recognize a fake CAPTCHA if it appeared on the website of a business you already trusted, or would the familiar site make you more likely to follow the instructions? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Copyright 2026 CyberGuy.com. All rights reserved.
