Stationary
Well-known member
Fake CAPTCHA challenges - stay vigilant
New attacks use realistic CAPTCHA to trick users into running malware
Sophisticated cyber-attack involving fake CAPTCHA prompts.
What is a CAPTCHA?
CAPTCHA is a widely used tool designed to distinguish humans from automated bots. For example, users may be asked to select all images containing bicycles to verify they are not bots.
Attackers are now exploiting this trusted format to deploy malware. They embed fake CAPTCHA challenges into compromised websites to deceive users and install malicious software.
How the attack works
The malicious process typically follows this sequence:
How to protect yourself
Trust your professional instinct. Your vigilance is our strongest line of defence. If a CAPTCHA prompt instructs you to take actions beyond clicking inside your browser window, treat it as highly suspicious. Close the site immediately and report the incident to the security team. CAPTCHAs should never require keystrokes outside their interface. Information Security advises all users to refrain from engaging with websites that display unexpected or suspicious CAPTCHA prompts, such as the example illustrated.
Do not use the following key combinations during any CAPTCHA interaction, as they may trigger malware execution:
New attacks use realistic CAPTCHA to trick users into running malware
Sophisticated cyber-attack involving fake CAPTCHA prompts.
What is a CAPTCHA?
CAPTCHA is a widely used tool designed to distinguish humans from automated bots. For example, users may be asked to select all images containing bicycles to verify they are not bots.
Attackers are now exploiting this trusted format to deploy malware. They embed fake CAPTCHA challenges into compromised websites to deceive users and install malicious software.
How the attack works
The malicious process typically follows this sequence:
- Users visit a compromised or malicious website and are presented with a realistic-looking CAPTCHA.
- Upon clicking a “Verify” button, malicious code is silently copied to the user’s clipboard.
- The site then instructs users to open a system prompt (such as Command Prompt, PowerShell, or the Windows Run dialog) and paste and execute the code.
- Once executed, the code connects to multiple attacker-controlled domains, triggering malware downloads and compromising the device—often before users even see a “Verification successful” message.
How to protect yourself
Trust your professional instinct. Your vigilance is our strongest line of defence. If a CAPTCHA prompt instructs you to take actions beyond clicking inside your browser window, treat it as highly suspicious. Close the site immediately and report the incident to the security team. CAPTCHAs should never require keystrokes outside their interface. Information Security advises all users to refrain from engaging with websites that display unexpected or suspicious CAPTCHA prompts, such as the example illustrated.
Do not use the following key combinations during any CAPTCHA interaction, as they may trigger malware execution:
- Windows + R – opens the Window Run dialog box (similarly, avoid opening tools like Powershell, Command Prompt or selecting “Install certificates”)
- CTRL + V – pastes potentially malicious code
- Enter – executes the code
