Phishing Trend Circulating Using Fake CAPTCHA Screens

We want to make you aware of a recent phishing trend circulating on Instagram and other platforms involving fake CAPTCHA verification screens. These scams are designed to appear like legitimate “I’m not a robot” checks but instead prompt users to follow unusual steps—such as pressing keyboard shortcuts or pasting commands into a system window. These actions can silently install malware (including credential-stealing programs) and compromise sensitive information like saved passwords, banking details, and cryptocurrency wallets.

CAPTCHA screens are simple security checks used by websites to confirm that a user is a real person and not an automated bot. You’ve likely seen CAPTCHA in forms like checking a box (“I’m not a robot”), selecting images (e.g., traffic lights or crosswalks), or typing distorted letters and numbers. Please be aware that legitimate CAPTCHA tools—such as those used by Google on trusted sites—will never ask you to run commands, paste code, or use system-level shortcuts.

Red flags include:

• unexpected pop-ups

• instructions beyond simply clicking images or a checkbox

• unfamiliar or suspicious website URLs

If you encounter any CAPTCHA prompt that behaves this way, close the page immediately and do not interact further. To protect yourself, avoid pasting commands into your device, use a password manager when possible, and ensure your system security tools are up to date. If you believe you may have engaged with a suspicious prompt, disconnect from the internet, run a malware scan, and update your passwords from a separate, secure device.