A persistent malware campaign is exploiting the ubiquitous CAPTCHA process to try to steal data from unsuspecting victims. Also: Got a suspicious E-ZPass text? It's a trap - how to spot the scam As described by security firm Malwarebytes in a new report, this scheme relies on the ease with which people often follow the steps in a CAPTCHA prompt without thinking. You land on a website that promises movies, music, pictures, news articles, or some other interesting content. A CAPTCHA prompt pops up, asking you to prove that you're not a robot. As we're all so used to these types of requests, many of us wouldn't think twice about accepting it. Also: Why rebooting your phone daily is your best defense against zero-click attacks But instead of the usual CAPTCHA challenge that asks you to choose certain images in a picture or identify distorted characters, this one serves up the instructions seen in the image below: At this point, most savvy users would realize that something is off here and exit the site. But remember that cybercriminals aren't targeting savvy users; they're trying to hit people who are less knowledgeable and more easily tricked. Even sophisticated users in a rush or on autopilot could fall prey to the trap. If you follow the steps, the website copies a text string to your Windows clipboard. Normally, you'd have to grant your permission for such an action, but you already did so by checking a checkbox on the first screen of the CAPTCHA prompt. Also: What is vishing...
That weird CAPTCHA could be a malware trap - here's how to protect yourself
ZDNet
·Lance Whitney
·Published Mar 12, 2025
·Updated
Affected Software
1 affected component
Microsoft Windows
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses how a malware campaign is exploiting CAPTCHA processes to steal data from victims.
2
What security implications are discussed in the article?
The article highlights the risks associated with interacting with suspicious CAPTCHAs that may lead to malware infections.
3
What products or software are affected by this malware campaign?
The malware campaign affects users across various platforms, including Microsoft Windows.
4
How can individuals protect themselves from this malware threat?
Individuals can protect themselves by being cautious with CAPTCHAs and avoiding suspicious links or messages.
5
What advice is provided for spotting fraudulent CAPTCHAs?
The article suggests looking for unusual requests or sources when encountering CAPTCHAs to determine their legitimacy.