Fake CAPTCHA pages are tricking users into installing malware

It seems we now have something new to worry about while browsing the web. Windows Central reports that hackers have discovered a new security vulnerability in Windows that allows them to install malicious software on your computer via fake CAPTCHA pages.

The hackers use fake CAPTCHA pages—which are designed to mimic standard security checks—to trick users into installing malicious software (“Stealthy StealC Information Stealer”) via keyboard commands.

Similar to another CAPTCHA attack from last year, users are prompted to press the Windows key + R shortcut (which launches the Windows Run prompt), followed by Ctrl + V (which pastes a malicious command into the Run prompt), and then Enter (which runs the malicious command). Experienced Windows users should immediately notice that something is wrong when a page asks you to open the Windows Run prompt and paste something using the shortcut action.

What ends up happening is that the fake CAPTCHA page loads a PowerShell command into your Windows clipboard, which is then executed when you following the instructions. That PowerShell command downloads malware without you noticing.

Security experts at Level Blue recently wrote that the new attack can be used to access login information for web browsers, Outlook, Steam accounts, and cryptocurrency wallets, among other things.