You’ve likely completed a legitimate CAPTCHA test before, those “Verify you are human”
prompts designed to block bots and protect websites. But in recent months, cybercriminals
have been using fake CAPTCHA tests to trick users into running malicious commands
on their devices. Once executed, this malware can steal credentials, browser cookies,
financial information, and other sensitive data.
How the scam works
Scammers add fake “verification steps” that may instruct you to:
- Press Win + R to open the Run dialog
- Press CTRL + V to paste a command
- Open Terminal or Command Prompt
- Paste commands and press Enter
DO NOT FOLLOW THESE INSTRUCTIONS!
A legitimate CAPTCHA will never ask you to copy, paste, or run commands on your device.
Protect Yourself
- Be suspicious of any CAPTCHA that asks you to copy/paste.
- Legitimate CAPTCHA tests only require actions such as clicking a checkbox, selecting images, or completing a simple challenge.
- Visiting a website with a CAPTCHA or clicking “Verify you are human” will not install malware.
- If something feels unusual, close the browser window and report it to your IT Security
team at security@uh.edu.
Learn more about Fake Captcha
Stay alert. CAPTCHAs are meant to protect you, but scammers use them against you.