You鈥檝e likely completed a legitimate CAPTCHA test before, those 鈥淰erify you are human鈥�
prompts designed to block bots and protect websites. But in recent months, cybercriminals
have been using鈥痜ake CAPTCHA tests鈥痶o trick users into running malicious commands
on their devices. Once executed, this malware can steal credentials, browser cookies,
financial information, and other sensitive data.
How the scam works
Scammers add fake 鈥渧erification steps鈥� that may instruct you to:
- 笔谤别蝉蝉鈥�Win + R鈥�to open the Run dialog
- 笔谤别蝉蝉鈥�CTRL + V鈥痶o paste a command
- 翱辫别苍鈥�Terminal鈥痮谤鈥�Command Prompt
- Paste commands and press鈥�Enter
DO NOT FOLLOW THESE INSTRUCTIONS!
A legitimate CAPTCHA will鈥�苍别惫别谤鈥�ask you to copy, paste, or run commands on your device.
Protect Yourself
- Be suspicious of any CAPTCHA that asks you to copy/paste.
- Legitimate CAPTCHA tests only require actions such as clicking a checkbox, selecting images, or completing a simple challenge.
- Visiting a website with a CAPTCHA or clicking 鈥淰erify you are human鈥� will鈥痭ot鈥痠nstall malware.
- If something feels unusual, close the browser window and report it to your IT Security
team at security@uh.edu.
Learn more about 鈥�
Stay alert. CAPTCHAs are meant to protect you, but scammers use them against you.