Fake Browser Update and Captcha Malware Targeting Crypto Users
How fake captcha malware and fake browser updates steal crypto: the paste-a-command trick, warning signs, protection steps and what to do if you ran it.
Fake captcha and fake browser update attacks trick you into installing malware yourself: a website shows a convincing "verify you are human" box or an "update your browser" warning, then instructs you to download a file or paste a command into your computer, which installs software that steals crypto wallet data, passwords and browser sessions. A real captcha or browser update never asks you to open a command window or run a downloaded file from a random site.
Crypto users are prime targets because a single infected computer can expose hot wallet files, seed phrases stored in notes, exchange sessions and password managers. This guide explains how these attacks work, the warning signs and what to do if you think you ran one.
How the Fake Captcha Trick Works
This technique, often called "ClickFix" by security researchers, turns the victim into the installer.
- 1You land on a page — perhaps a hacked blog, a fake document viewer, a pirated software site or a link sent in a crypto community chat.
- 2A familiar-looking check appears, styled like a well-known captcha service, saying you must verify you are human.
- 3When you click the box, the page silently copies a malicious command to your clipboard.
- 4New instructions appear: on Windows, "press Windows + R, then Ctrl + V, then Enter"; on a Mac, a variant may ask you to open Terminal and paste.
- 5You run the command without seeing it fully. It downloads and starts malware in the background.
- 6The page may say "verification complete" and let you continue, so nothing seems wrong.
The trick works because it bypasses many browser protections: you, not the website, run the program.
How Fake Browser Update Attacks Work
The older cousin of fake captchas is the fake update banner:
- A compromised or malicious site overlays a full-screen message saying your browser is outdated or a page cannot be displayed without an update.
- The page imitates your browser's branding and offers a download button.
- The file is malware, often disguised as an installer or a compressed file containing a script.
Real browsers update automatically or through system updates. You never need to download a browser update from a site you happened to be visiting.
What the Malware Steals
Most of these campaigns deliver information stealers — malware that quickly collects valuable data and sends it to the attacker. For crypto users that can include:
| Data stolen | Why it matters |
|---|---|
| Browser wallet extension data | Encrypted vaults can be cracked offline if the password is weak or saved |
| Saved passwords and autofill | Exchange logins, email accounts and wallet passwords |
| Session cookies | Attackers can sometimes hijack logged-in sessions without needing a password or 2FA code |
| Files and notes | Screenshots or text files containing seed phrases |
| Clipboard | Some malware swaps copied addresses; see clipboard malware |
Because stealers act within seconds, losses may happen before you notice anything unusual.
A Hypothetical Example
The following is a composite illustration, not a real case.
Imagine Alex, who searches for a free chart tool and opens a download site. A captcha box appears. After clicking it, Alex is told to press Windows + R and paste to "complete verification." It feels odd, but the site looks professional. A few hours later, Alex's browser wallet is emptied and an exchange account shows a withdrawal attempt. The stealer had copied the wallet's encrypted data, saved passwords and session cookies within minutes of running.
Warning Signs Checklist
- A "captcha" asks you to use keyboard shortcuts, open Run, Terminal or PowerShell, or paste anything.
- A website, not your browser, says you must download an update.
- A download arrives as a script, shortcut or unusual file type instead of a normal installer from the official vendor.
- The page appeared after a redirect from a site you didn't expect, or from a search ad.
- A link in a Discord, Telegram or X conversation leads to a "verification" step.
- Your browser or antivirus warns about the file and the page tells you to ignore it.
How to Protect Yourself
- 1Never paste commands you don't understand, especially from a web page.
- 2Update software only from official sources: the browser's settings menu, the operating system's update tool or the vendor's official website.
- 3Keep seed phrases offline. Never store them in notes apps, screenshots or cloud documents. See how to back up a seed phrase the right way.
- 4Use a hardware wallet for meaningful amounts, so private keys never sit on your computer.
- 5Use a password manager with a strong master password, and enable app-based or hardware-key 2FA on exchanges and email.
- 6Separate activities: consider a dedicated device or browser profile for crypto that you don't use for downloads or browsing random sites.
- 7Be careful with search ads for software and crypto tools; our guide to phishing through search ads explains why.
What to Do If You Ran It
- 1Disconnect the infected device from the internet.
- 2From a clean device, create a new wallet with a fresh seed phrase and move funds from any wallet that was on the infected computer. Follow what to do immediately if your wallet is compromised.
- 3Change passwords for email, exchanges and your password manager, starting with email, and log out all active sessions.
- 4Revoke token approvals from any affected wallet you keep using.
- 5Wipe and reinstall the infected computer, or have a professional do it; removing stealers manually is unreliable.
- 6Report the malicious site to your browser's safe-browsing reporting tool and to us through our report form.
Bottom line
Fake captchas and fake updates succeed because they make you run the malware yourself. No real verification asks you to paste a command, and no real browser needs a download from a random page. Keep keys off everyday computers, update only from official sources, and if you slipped, act quickly from a clean device.
Frequently asked questions
What is a fake captcha attack?
A fake captcha attack shows a page that looks like a normal 'verify you are human' check, but instead of clicking images it asks you to press keyboard shortcuts that open a command window and paste a hidden command. That command downloads malware, often an information stealer that targets crypto wallets, passwords and browser data.
Would a real captcha ever ask me to run a command?
No. Legitimate captchas ask you to tick a box, click images or solve a puzzle in the browser. They never ask you to open the Run dialog, Terminal or PowerShell, or to paste anything. Any instruction to do so is an attack and you should close the page.
Do browsers really need manual updates from websites?
Modern browsers such as Chrome, Firefox, Edge and Safari update themselves or through your operating system's update system. A website telling you to download a browser update file is almost always malicious. Check for updates only from the browser's own settings menu.
I ran the command. Is my crypto safe?
Assume it is not. Disconnect the computer, use a different clean device to move funds from any hot wallet whose keys or phrase were on that computer to a new wallet, change important passwords from the clean device and revoke active sessions. Then have the infected computer wiped and reinstalled.