These checks are called CAPTCHAs, short for Completely Automated Public Turing test to tell Computers and Humans Apart. Websites use them to make sure a person, not an automated program, is signing up for an account or filling out a form. Automated programs, called bots, can create thousands of fake accounts, and CAPTCHAs help keep them out.

The scam starts with a page that shows what looks like a normal check. Sometimes it’s an obvious fake site, but often it’s a legitimate website that criminals have hacked or a page you reached from an ad or a link in an email. Instead of asking you to check a box or pick out pictures, the fake CAPTCHA gives you a short list of keyboard steps and says they will verify you’re human.

When you click the fake box, the page copies a hidden command to your computer’s clipboard, the same place text goes when you copy and paste. The keyboard steps open a tool on your computer and paste in that command so it runs. In seconds, you’ve installed the malware yourself.

That malware is usually an infostealer, a program that collects the passwords saved in your browser along with the logins for your email and bank accounts and sends them to criminals. Thieves can then get into your accounts, often before you notice.

The scam is fairly new. Security researchers first spotted it in 2024, and it grew 517% in the first half of 2025 compared with the previous six months, according to the security firm ESET. Microsoft reported that 47% of the attacks its security experts investigated began this way, more than phishing emails, which accounted for 35%.

Part of what makes the scam work is that legitimate CAPTCHAs have changed. The old puzzles with wavy letters and grids of buses or crosswalks are easy for today’s AI to solve. In 2024, researchers at ETH Zurich in Switzerland found that AI could solve Google’s picture puzzles every time. As a result, many sites now check visitors in the background, and most of the time you won’t see anything at all.

Behind the scenes, the site looks at how you move your mouse. A person’s path to a button curves and changes speed, while an automated program tends to move in a straight line or jump right to it. The site also checks whether your browser has visited before. If you use private browsing or clear your cookies often, you look like a stranger, and you’re more likely to be asked to check a box. Once in a while, you may still get a picture puzzle.

Whatever form it takes, a legitimate CAPTCHA stays on the web page. It will never ask you to press a combination of keys or paste something. As the FTC puts it, “Real CAPTCHAs won’t ask you to run commands on your device.”

Be suspicious of a check that comes with numbered instructions or one that pops up right after you click a link in an email or ad. If something feels off, close the tab.

If you saw a fake CAPTCHA but closed the page without following the steps, your computer is most likely fine. Seeing the page alone doesn’t install anything. If you did follow the instructions, you may have seen a window flash open and close or a download you didn’t ask for. Disconnect from the internet, then focus on two things. First, run a deeper scan than usual. On a Windows PC, the Microsoft Defender offline scan restarts your computer and checks it before malware has a chance to hide. Open Windows Security, choose Virus & threat protection, then Scan options, and select Microsoft Defender Antivirus (offline scan).

Second, change your passwords from a different device, such as your phone. An infostealer can record what you type, so new passwords entered on the infected computer could go straight to the thieves. Start with your email and bank accounts.

Advanced users may recognize the tools these scams rely on. Fake CAPTCHAs tell Windows users to open the Run box or PowerShell and Mac users to open Terminal. Macs updated to macOS Tahoe 26.4 now show a warning when you paste a suspicious command into Terminal. If you see it, click Don’t Paste.

The rule to remember is easy. A legitimate CAPTCHA only asks you to click inside the web page, so if one asks for anything more, close it and move on.

Leslie Meredith has been writing about technology for more than a decade. As a mom of four, value, usefulness and online safety take priority. Have a question? Email Leslie at asklesliemeredith@gmail.com.