Microsoft warns fake CAPTCHA tests are hijacking Windows PCs

Microsoft is warning Windows users about a growing cyber threat that hides behind something that looks completely harmless: a CAPTCHA test. Hackers use fake verification pages to trick victims into following instructions that can secretly run malicious commands on their computers, turning a routine security check into a dangerous trap. The attacks are becoming more convincing, making it harder for users to spot the warning signs. Read on to learn how these fake CAPTCHA tests work and what Microsoft says users should watch for.

How the trap unfolds

When navigating the web, encountering a CAPTCHA — a short test asking you to check a box or identify images — has become second nature. Attackers behind this newly identified “ClickFix” campaign exploit that muscle memory.

It all begins when a user visits a compromised website. Instead of a normal webpage, a fraudulent verification or repair window pops up, mimicking a standard security check. But unlike legitimate CAPTCHA…