Rogue CAPTCHAs: Look out for phony verification pages spreading malware

This ESET article warns of a growing social-engineering vector—fake CAPTCHA verification pages (ClickFix)—used to trick users into executing clipboard-pasted commands that launch legitimate Windows tools (PowerShell, mshta.exe) to fetch and install malware. The scam has been used to deploy infostealers, remote access trojans, cryptominers and ransomware at scale; the piece explains why the technique works, examples of malicious behaviors, recommended user defenses (updates, reputable AV, ad blockers, MFA, password managers) and post-infection remediation steps.