‘Prove you are not a robot’: how the Captcha scam captures your computer

Unlike familiar Captcha tests, this con asks you to press a series of keys. And that’s a way in for fraudsters to install malicious software

You are looking for some gifts for Christmas and want to support small businesses when you shop. When you visit the site of one you’ve heard good things about you are asked to verify that you are human.

Instead of clicking on a series of images, or typing letters that appear, just as you have seen before, you are asked to press a series of keys and then press enter.

This is a tactic known as the “ClickFix” scam one of the most popular used by criminals to trick people into infecting their own computer with malicious software, according to Chris Fistonich, a researcher with cybersecurity company Malwarebytes.

“ClickFix is really one of the most sophisticated malware campaigns there is,” he says. “People are not prepared for this. They are used to solving Captchas every day. They’re used to being able to trust their security software. So it really has opened a new security loophole that’s being exploited extensively.”

He adds: “This is the most popular way to get malware on to your computer. Certainly not the only way, but today it is definitely the most popular.”

Captcha tests are familiar to many people as ways for a website to distinguish real from automated users. They often involve being shown a photograph and asked to do simple tasks, such as clicking on bikes or trains, or typing out grainy numbers.

The ClickFix fraud looks similar. The message may say “Verify you are human by completing the action below” and request you tick a box. By checking the box, you have given the system permission to copy some malicious code to the clipboard on your computer.

It will then ask you to carry out a task:

“To better prove you are not a robot, please: Press & hold the Windows Key + R. In the verification windows, press Ctrl + V. Press Enter on your keyboard to finish.”

This combination of actions pastes the text into your system and means your computer will be infected.

In other versions of the same scam, you might be told that “something went wrong when displaying this webpage” with similar instructions to fix the issue.

Like many scams, the ClickFix fraud relies on people acting quickly and without thinking through their actions properly, so pause and consider what you are doing whenever you are online.

Some security software systems can block malicious websites with malware traps on them, so check what you have in place.

If you have been compromised, contact your bank immediately. Then change your passwords, with the most important first.