You land on the real website of a local business and a CAPTCHA appears. It looks routine until the page tells you to open Windows Run and paste a command. That should stop you cold.
Security researchers say thousands of legitimate small-business websites have been compromised to spread this malware trap. Here’s what to know before a familiar website catches you off guard.
NEW! Join our upcoming CyberGuy LIVE class: Get Better Health Care With AI
In this free live online class, Kurt “CyberGuy” Knutsson will show you five practical ways AI can help you take a more active role in your health care. You’ll learn how to organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare questions for your next doctor’s visit. No technical experience is needed.
Register for free now at CyberGuyLive.com
FAKE PATIENT PORTAL SCAM CAN STEAL YOUR LOGIN AND INFECT YOUR PC
This campaign is much bigger than a handful of infected pages. Netskope Threat Labs says it identified more than 5,400 compromised websites across more than 2,200 organizations worldwide over the past few months.
The sites have little in common beyond many belonging to small businesses. Researchers found clinics, plumbing companies, online stores and other businesses among the victims.
Where Netskope examined individual sites, they most often ran WordPress and sometimes PrestaShop. Researchers still do not know how attackers initially compromised them.
That is important because you could visit the legitimate website of a business you recognize and still encounter a malicious prompt.
Netskope says several hundred compromised sites can be active on a given day. It has recently seen more than 300 sites contacting the malicious infrastructure each weekday.
The attack starts with malicious code hidden inside a compromised website. When you visit the site, that code can load another script. Then the page may blur and show what looks like an ordinary CAPTCHA.
Instead of simply asking you to prove you are human, the page tells you to open the Windows Run dialog and paste a command. That command can download and launch the attacker’s malware.
Here is the warning sign I want you to remember: A legitimate CAPTCHA should never tell you to open Windows Run or paste a command into your computer.
We have seen fake CAPTCHA scams use this same trick before. The page looks familiar, so you may assume the instructions are part of a normal security check. They are not. The criminal is trying to get you to launch the attack yourself.
CLICKLOCK MAC MALWARE LOCKS APPS UNTIL YOU GIVE IN
This technique is known as ClickFix. The clever part has less to do with some exotic computer hack and more to do with psychology.
You are already used to CAPTCHAs. Websites ask you to click a box or prove you are human all the time. So, when a convincing verification screen appears on a legitimate website, your guard may be down. Then the instructions make the dangerous action look like one more step in the verification process.
Cybercriminals have used similar ClickFix tricks with fake Windows update screens. The appearance changes, but the warning remains the same. A webpage should not be telling you to run computer commands.
This is where the campaign gets more unusual. The attackers are using the BNB Smart Chain test network to store instructions used by the compromised websites.
You do not need to understand cryptocurrency to understand why criminals like this setup. Normally, attackers might keep malicious code on a regular web server. Once investigators find that server, a hosting provider may be able to shut it down.
A blockchain works differently. In this campaign, the attackers store code inside something called a smart contract. Think of it as a place where the hacked websites can check for their next set of instructions.
Netskope says the attackers are using the test version of BNB Smart Chain. Developers normally use this network to experiment without spending real cryptocurrency.
That gives the criminals inexpensive infrastructure that can also be harder to take down through traditional methods. There is another advantage.
The attacker can change what the smart contract delivers. The compromised websites can then pick up those new instructions without criminals having to modify every hacked site individually. That helps explain why this infrastructure is so useful to them.
Netskope also found a newer version of the attack that skips the fake CAPTCHA. This version uses technology called WebRTC. Your browser normally uses WebRTC for things such as video calls and real-time communications. The attackers found another use for it.
Their code can create an encrypted data connection with the attacker and receive additional malicious code through the browser. Netskope says the code can then run without first being saved as a traditional file on the computer.
For you, the technical details are less important than the larger point. The criminals can change how the attack works while continuing to use the same network of compromised websites.
A few simple habits can help you avoid handing control of your computer to an attacker.
If a website tells you to open Windows Run, PowerShell or Command Prompt, stop. Do not paste anything it gives you. Close the page instead.
A normal CAPTCHA may ask you to click a checkbox or identify pictures. It should not require you to change settings or run commands on your PC. If the instructions suddenly leave the browser, close the page.
Strong antivirus protection can help detect malicious scripts and malware if something slips past you. Keep it updated and enable real-time protection. If you accidentally follow suspicious instructions, run a full system scan. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com
Install security updates when they become available. However, update Windows through Windows Update. Update your browser through its built-in settings or official source. Do not trust an unexpected webpage that says you must download an update.
If you followed the instructions from a suspicious CAPTCHA, disconnect the computer from the internet. Run a full antivirus scan. Then use another trusted device to change passwords for sensitive accounts you accessed on that computer. Start with your main email account. Also review active login sessions and enable multifactor authentication wherever you can.
Website owners should take this campaign seriously too. Netskope recommends checking the integrity of your content management system files. Researchers found malicious code added to legitimate JavaScript files or hidden inside fake plugin directories. Keep WordPress, PrestaShop and any plugins you use updated. Remove plugins you no longer need. Keep in mind that Netskope has not identified how attackers initially broke into the websites in this campaign. Those steps are good security practices, but researchers have not tied a specific WordPress or PrestaShop vulnerability to these compromises.
What gets me about this attack is how ordinary everything can look at first. You could be visiting the real website of a neighborhood business you have used before. Then a familiar CAPTCHA appears. That sense of trust is exactly what can make the next instruction dangerous. The blockchain technology behind the campaign makes life harder for security teams trying to shut it down. For the rest of us, though, the best defense is refreshingly simple. A website should never need you to open Windows Run or paste a command to prove you are human. If you see that request, close the page. That one warning sign could save you from installing malware yourself.
Would you recognize a fake CAPTCHA if it appeared on the website of a business you already trusted, or would the familiar site make you more likely to follow the instructions? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
