A growing scam repurposes the familiar CAPTCHA prompt to trick users into running malware. Instead of asking users to identify traffic lights or crosswalks, the fake page instructs them to perform a series of steps that ultimately download and execute a malicious program. The user believes they are proving they are human, but they are actually carrying out the attacker's payload.
Bruce Schneier, writing on his security blog, describes this as a new variant of an old scam. The technique is notable because it exploits the trust and muscle memory people have built around CAPTCHAs, which are normally a safeguard against bots. By framing the malicious action as part of a verification process, the attacker lowers the victim's guard.
No other sources were available for comparison, so this analysis is based solely on Schneier's report. The key takeaway is that users should be wary of any CAPTCHA that asks them to copy commands, open dialog boxes, or download files, as legitimate verification rarely requires such actions.