FOLLOW US

A deceptively simple scam disguised as a familiar CAPTCHA prompt is giving hackers direct access to victims’ computers, turning an everyday security check into a high-risk gateway for identity theft, surveillance, and stolen credentials.

What looks like a routine “prove you’re human” screen is being weaponized by cybercriminals to trick users into executing hidden commands that can silently hand over control of their device.

Once that happens, experts say, the damage can be immediate and severe.

What we know:

A new scam using fake CAPTCHA authentication screens allows hackers to access your computer.

Instead of seeing a standard CAPTCHA window where you select items from a grid of photos, type a word or check a box, hackers are tricking people into typing a series of keys that allow them access to the computer.

"So, you end up running what they wanted you to run, but unbeknownst to you," said Federico Giovannetti, an assistant professor of cybersecurity at the University of Tampa.

Scammers will ask someone to run the Windows Key + R and then Control Key + V to paste a hidden command that was copied to the computer's clipboard when the CAPTCHA window popped up. This will run a program that will allow the hackers into the computer.

This technique is called social engineering. It is where bad actors use something people are familiar with — in this case CAPTCHA — to trick people into doing something they should not do.

"A lot of people just work on automatic, right," Giovannetti said. "They don't stop to think, why am I doing this? And that is one of the techniques used in deception and in social engineering, because we just don't stop to think."

Why you should care:

Once attackers gain access, the consequences go far beyond a simple inconvenience.

When bad actors get ahold of access to a computer, they can steal personal information.

Eva Velasquez is the CEO of the Identity Theft Resource Center. The nonprofit helps people prevent or respond to scams and hackers.

"They can see when you're typing in your username and password for a variety of different sites, they may be able to even take screenshots of your computer so they can see what you're doing," Velasquez said. "Really, it's an all-access pass to anything that you're working on."

What they're saying:

Cybersecurity experts say the biggest defense is slowing down and questioning unexpected prompts that ask for unusual actions.

Prevention is key, so slow down, and think about what you're doing on the computer before you do it.

"I'm not saying to be paranoid when you're online, but at least be a little bit skeptical and suspicious of when you are being asked to do things that you don't normally experience in your interactions online," Giovannetti said.

What you can do:

The Identity Theft Resource Center can help when people get caught up in a scam like this. You can find more information about it here.

"We provide free recovery services if you have been a victim of scams, fraud, identity theft, but we also help people in the moment," Velasquez said. "Maybe they've gotten a strange text message or an email, or they got a phone call, and they're not sure."

Experts also suggest installing antivirus software on computers to stop hackers in their tracks.

What we don't know:

While this scam is widespread, it is unclear exactly how many people have fallen victim.