Beware of 'I Am Not a Robot' Scam: Bank Accounts Can Be Drained Instantly

A new fraud scheme exploits fake CAPTCHA prompts to lure victims, potentially leading to financial losses and the theft of sensitive information. CAPTCHA is a security feature used on websites or applications to verify whether a user is a real human or an automated bot.

Findings from Kaspersky reveal that this modus operandi targets Windows PC users while they are browsing. Potential victims encounter an advertisement that covers the entire screen and attempt to close it. However, clicking the ad redirects them to a fake CAPTCHA page and a counterfeit Chrome error message, designed to trick users into downloading malware known as a stealer.

‘Criminals purchase several ad slots, and if a user sees and clicks on these ads, they are directed to a malicious website. This new scheme involves a significantly expanded distribution network and the introduction of new attack scenarios that reach more victims,’ said Vasily Kolesnikov, Security Expert at Kaspersky, in a written statement on the company’s official website.

‘Users can now be deceived by fake CAPTCHA commands or fake Chrome web page error messages, making them victims of theft. Both corporate and individual users must be cautious and think critically before following suspicious commands they see online,’ he added.

Clicking the ‘I am not a robot’ button on the fake CAPTCHA copies a malicious script to the clipboard. Victims are then prompted to paste it into the terminal, which actually downloads and launches a trojan like Lumma. This malware steals sensitive information, such as crypto assets, cookies, and password manager data. It can also capture screenshots, obtain remote access service credentials, and control the victim’s device by downloading remote access tools.

This incident has targeted numerous users across various countries, including Brazil, Spain, Italy, and Russia. According to Kaspersky Telemetry, more than 140,000 malicious ad incidents were detected between September and October 2024, with over 20,000 users redirected to fake pages containing malicious scripts.