Cybercriminals Exploit CAPTCHA Checks to Steal Sensitive Information

Select all the traffic lights. Click on the motorcycles. Identify the buses. Or simply tick the box that says “I am not a robot”. For most internet users, CAPTCHA tests are an irritating but familiar part of being online. They are also becoming a weapon in the hands of cybercriminals. Hackers are imitating these human-verification checks to trick people into downloading malware, executing malicious commands and handing over sensitive information. A recent campaign targeting Israeli organisations shows how this works. Since September, hackers have been impersonating the Israel Tax Authority through phishing emails and fake government websites. Employees receive messages asking them to download tax documents, a routine task for finance, accounting and administrative departments. The websites display CAPTCHA-style checks before offering a ZIP file containing what appears to be an official document. But opening the file installs SimpleHelp, a legitimate remote-access software programme that attackers can use to control the infected computer. This tactic is not confined to Israel. Ukraine’s Computer Emergency Response Team (CERT-UA) has warned that Russian-linked hacking group Sandworm is using fake CAPTCHA checks on compromised websites to infect computers. Visitors are instructed to copy and paste a PowerShell command into their machines to complete verification. Instead, executing the command downloads malicious software. Known as ClickFix, the technique exploits a simple human instinct where a website tells something is wrong and a non-robot human follows its instructions to make it work. The difference is that instead of fixing a technical glitch, users end up compromising their own computers. It is rather like being asked to hand a thief the keys to your house to prove you live there. The infrastructure supporting these attacks is also evolving. In an investigation published in August, cybersecurity firm Netskope Threat Labs identified more than 5,400 compromised websites across over 2,200 organisations using blockchain-based infrastructure to distribute malicious code. The campaign, known as EtherHiding, uses smart contracts on a blockchain to store and retrieve malicious scripts. When someone visits an infected website, the code can display a fake CAPTCHA asking them to execute a command on their computer. Attackers can update the malicious instructions stored on the blockchain without having to modify the compromised website itself. The malware delivered through these campaigns can steal passwords, financial information and other sensitive data. Some variants target banking credentials and two-factor authentication codes, potentially giving attackers access to accounts protected by additional security checks. Apple users are not spared either. A 2026 investigation by cybersecurity firm Huntress documented a fake CAPTCHA attack that infected a Mac with malware capable of collecting passwords stored in Apple’s Keychain and accessing cryptocurrency wallets. Meanwhile, genuine CAPTCHA systems are facing a different problem where AI is getting better at solving them. The tests were designed to distinguish humans from automated programmes through image recognition, distorted text and visual puzzles. But AI models are capable of completing these challenges. In an experiment, Dorian Schultz, red-team data scientist at AI security platform SPLX, demonstrated how a ChatGPT agent could be persuaded through prompt injection to solve image- and text-based CAPTCHA tests. While the agent still needed assistance with certain interactive puzzles, the demonstration highlighted the limitations of relying on visual challenges to distinguish humans from bots. For consumers, however, one warning sign is important as a legitimate CAPTCHA will not normally ask users to open Windows Run, PowerShell or Mac Terminal and paste a command. Any such instruction should be treated with suspicion, even if it appears on a familiar website. Cybersecurity experts recommend accessing banking and government services by typing official website addresses directly rather than following unsolicited email links. Users should avoid downloading unexpected executable files, keep operating systems updated and use password managers and two-factor authentication. So next time a website asks you to identify a traffic light, take a moment before clicking on it enthusiastically.