Technology

From CAPTCHA to catastrophe: How fake verification pages are spreading malware

Published

1 year ago

December 18, 2024

From CAPTCHA to catastrophe: How fake verification pages are spreading malware

When you visit a webpage, you might see a CAPTCHA to make sure you’re a real person and not a bot. These usually involve jumbled words, some recognizable images or just a box that says, “I am not a robot.”

CAPTCHAs are harmless, but hackers are now using them to infect your PC with malware.

Security researchers have found a huge fake CAPTCHA campaign spreading the dangerous Lumma info-stealer malware, which can bypass security measures like Safe Browsing.

This campaign shows how malvertising works, with more than a million ad impressions every day and thousands of victims losing their accounts and money through a network of more than 3,000 sites. I’ll break down how this scam works, who’s responsible and how you can protect yourself.

GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE

Illustration of a scammer (Kurt “CyberGuy” Knutsson)

How does the scam work?

As reported by Guardio, the fake CAPTCHA scam is a sophisticated malvertising campaign that lures you into unknowingly installing malware under the guise of routine CAPTCHA verification. The cyberattack starts when you’re browsing websites, often those offering free streaming, downloads or pirated content. These sites are used by hackers to present you with what appears to be a legitimate CAPTCHA verification page.

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

The page mimics a real CAPTCHA, asking you to confirm you are human. However, the instructions are designed to trick you into initiating harmful actions, like triggering the Windows “Run” dialog. Users unknowingly paste and execute a crafted PowerShell command, which silently installs the Lumma info-stealer malware onto their system.

The malware targets sensitive data, including social media accounts, banking credentials, saved passwords and personal files, potentially leading to financial and identity theft.

Illustration of fake CAPTCHA (Guardio)

HERE’S WHAT RUTHLESS HACKERS STOLE FROM 110 MILLION AT&T CUSTOMERS

Who’s to blame for this?

The fake CAPTCHA scam shows how messy the internet’s ad system has become, with everyone involved passing the buck. Guardio Labs points to ad networks like Monetag as a big part of the problem. They distribute malicious ads that are disguised during moderation using tricks like cloaking. Publishers, especially those offering free or pirated content, add to the issue by running these shady ads on their sites, often without checking what they’re actually showing users.

Then there are services like BeMob, which lets scammers hide their bad links behind harmless-looking URLs. These companies call themselves analytics tools, but they’re helping the scams stay hidden. Hosting providers don’t escape blame either. They’re where these fake CAPTCHA pages live, and they often don’t bother to check what’s being hosted.

Of course, the scammers themselves are the ones pulling the strings. But because they spread their operations across so many platforms, they’re almost impossible to track down. Guardio’s research shows how all these moving parts work together, creating a system where no one takes responsibility, and the scams keep running.

Illustration of a scammer at work (Kurt “CyberGuy” Knutsson)

BEWARE OF ENCRYPTED PDFs AS LATEST TRICK TO DELIVER MALWARE TO YOU

6 ways to stay safe from fake CAPTCHAs

1. Use reliable security software: Keeping your antivirus and anti-malware software up to date is one of the most effective ways to protect yourself from fake CAPTCHA scams. A strong antivirus software will detect and block malware like the Lumma info-stealer before it can infect your device. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.

2. Enable browser protection features: Modern browsers offer built-in security features, such as Safe Browsing and phishing protection, which warn you about potentially dangerous sites. Make sure these features are enabled in your browser settings. These tools can alert you to malicious links or fake CAPTCHAs trying to trick you into downloading malware.

3. Be cautious with “free” content: There’s a saying that goes, “If something is free, you’re what they are selling.” Websites that offer free downloads, streaming services or pirated content are often associated with malvertising campaigns. Fake CAPTCHA scams are commonly spread through these types of sites, where users are tricked into clicking on malicious ads or links. Even if a site seems tempting, it’s important to be cautious. Avoid clicking on suspicious links or using “free” services, as they could be traps designed to infect your device with malware.

4. Avoid clicking on suspicious ads: Always be wary of ads that appear out of nowhere or seem too good to be true. Fake CAPTCHA scams often disguise themselves as legitimate ads, asking you to click to verify you’re human. Never interact with pop-up ads or unfamiliar banners, especially those that claim to give you something for free, as they may lead to malicious pages or trigger malware downloads. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.

5. Check for HTTPS and look for signs of a legitimate site: Before entering any personal information or interacting with a CAPTCHA, ensure that the website is secure. Look for “https://” in the website’s URL, which indicates the connection is encrypted. Legitimate websites also tend to have a professional appearance, so if something feels off or the design looks poor, trust your instincts and leave the site.

6. Enable two-factor authentication: Two-factor authentication adds an extra layer of security, making it harder for attackers to access your accounts.

WHAT TO DO IF YOUR BANK ACCOUNT IS HACKED

Kurt’s key takeaway

There’s no question that fake CAPTCHA scams are a growing threat, putting millions of us at risk of malware infections and financial loss. What’s even more concerning is that ad networks, publishers and hosting services continue to allow malicious campaigns to spread through their platforms despite the widespread awareness of the problem. The companies involved must take immediate action to improve content moderation, tighten security measures and prevent these scams from thriving. We are seeing a dangerous loophole in the digital advertising ecosystem that could have serious consequences for internet users.

Do you think ad networks and publishers should be held accountable for the spread of malware through their platforms? Let us know by writing us at Cyberguy.com/Contact.

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most asked CyberGuy questions:

New from Kurt:

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Technology

Adobe actually won’t discontinue Animate

Published

7 hours ago

February 4, 2026

Press Room

Adobe actually won’t discontinue Animate

Adobe is no longer planning to discontinue Adobe Animate on March 1st. In an FAQ, the company now says that Animate will now be in maintenance mode and that it has “no plans to discontinue or remove access” to the app. Animate will still receive “ongoing security and bug fixes” and will still be available for “both new and existing users,” but it won’t get new features.

An announcement email that went out to Adobe Animate customers about the discontinuation did “not meet our standards and caused a lot of confusion and angst within the community,” according to a Reddit post from Adobe community team member Mike Chambers.

Animate will be available in maintenance mode “indefinitely” to “individual, small business, and enterprise customers,” according to Adobe. Before the change, Adobe said that non-enterprise customers could access Animate and download content until March 1st, 2027, while enterprise customers had until March 1st, 2029.

Technology

Your phone shares data at night: Here’s how to stop it

Published

8 hours ago

February 4, 2026

Press Room

Your phone shares data at night: Here’s how to stop it

NEWYou can now listen to Fox News articles!

If your smartphone stays on your bedside table overnight, it stays busy long after you fall asleep.

Even while it appears idle, your phone continues to send and receive data in the background. Some of that activity is expected. Your device checks for security patches, syncs system settings and keeps essential services running. Other data transfers are far less obvious and far less necessary.

Experts warn that smartphones routinely transmit tracking and advertising signals without you fully realizing it. In many cases, that data includes information that should only be shared with clear and informed consent.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

SUPER BOWL SCAMS SURGE IN FEBRUARY AND TARGET YOUR DATA

Even while you sleep, a nearby smartphone can continue sending and receiving data in the background. (Getty Images/monkeybusinessimages)

What data your phone sends while you sleep

Your phone is not just charging overnight. It operates in a continuous data loop that generally falls into two categories.

Legitimate system data

This includes updates, crash reports and basic diagnostics. Operating systems rely on this information to fix bugs, improve stability and protect against security threats. In most cases, this data collection is disclosed and configurable.

Tracking and advertising data

This is where concerns grow. Smartphones also transmit location signals, device identifiers, advertising IDs, usage patterns and app behavior data. Companies combine this information to build detailed user profiles and deliver targeted ads that promise higher engagement. The problem is that the line between necessary diagnostics and commercial tracking is often blurry. Many of us never realize how much data flows out of our phones overnight.

TIKTOK AFTER THE US SALE: WHAT CHANGED AND HOW TO USE IT SAFELY

Phones often stay active overnight, syncing apps, checking networks and refreshing data unless you limit background activity. (Kurt “CyberGuy” Knutsson)

What we know about phone tracking today

Independent academic investigations found that some Android devices transmitted data linked to tracking behaviors involving major companies like Meta and Yandex. The research, conducted by teams from IMDEA Networks Institute and European universities, showed that certain apps and services continued communicating with external servers even after users attempted to limit tracking. The researchers observed data flows that could link web activity with app identifiers, raising concerns about how effectively privacy controls were enforced at the system level.

There is also long-standing concern around smartphones appearing to “listen” to conversations. While no public evidence shows that phones actively record private speech for advertising, many users report ads that closely mirror recent conversations. At a minimum, aggressive data collection combined with location, app usage and search history can make these moments feel unsettling.

Despite years of scrutiny, most smartphones still operate this way today. The good news is that you can reduce how much data leaves your device.

How to protect yourself from overnight data sharing

You do not need to give up your smartphone to regain control. Small settings changes can make a real difference.

1) Review app permissions

Start with your installed apps. Focus on those with access to your location, microphone, camera and tracking data. Only allow sensitive permissions while the app is in use. Be especially cautious with apps that run continuously in the background.

How to review app permissions on iPhone

Open Settings
Tap Privacy & Security
Tap Location Services, Microphone, Camera or Tracking
Select an app from the list
Choose While Using the App or Never when available

For tracking controls:

Go to Settings
Click Privacy & Security
Tap Tracking
Turn off Allow Apps to Request to Track

This prevents apps from accessing your advertising identifier and sharing activity across apps and websites.

AI WEARABLE HELPS STROKE SURVIVORS SPEAK AGAIN

Turning off app tracking on your iPhone blocks apps from linking your activity across other apps and websites. (Kurt “CyberGuy” Knutsson)

How to review app permissions on Android

Settings may vary depending on your Android phone’s manufacturer.

Open Settings
Tap Privacy & Security or Security and privacy
Click More privacy settings
Tap Permission Manager
Select Location, Microphone, Camera or Sensors
Tap an app and choose Allow only while using the app or Don’t allow

To review background access:

Go to Settings
Click Apps
Select an app
Tap Mobile data & Wi-Fi
Turn off Background data if the app does not need constant access

This limits silent data transfers when the app is not actively open.

2) Limit background activity

Disabling background activity reduces how often apps sync data when you are not using them. This also limits automatic cloud activity. Keep in mind that this may affect real-time backups or notifications. Weigh the convenience against the privacy trade-off.

How to limit background activity on iPhone

Turn off Background App Refresh

Open Settings
Tap General
Tap Background App Refresh
Tap Background App Refresh at the top
Select Off or Wi-Fi

To disable it for specific apps:

Stay on the Background App Refresh screen
Toggle off apps that do not need to update in the background

This prevents apps from quietly syncing data when they are not open.

How to limit background activity on Android

Settings may vary depending on your Android phone’s manufacturer.

Restrict background data

Open Settings
Tap Apps
Select an app
Tap Mobile data & Wi-Fi
Turn off Background data

Restrict background battery usage

From the app’s settings screen, tap Battery
Select Restricted or Limit background usage

This reduces background syncing and prevents apps from running silently when you are not actively using them.

3) Turn off personalized advertising

Personalized ads rely on device identifiers and activity data collected across apps. Turning this off limits how your behavior is used for ad targeting, even when your phone is idle.

How to turn off personalized ads on iPhone

Open Settings
Tap Privacy & Security
Tap Tracking
Turn off Allow Apps to Request to Track

To limit Apple ads:

Go to Settings
Click Privacy & Security
Tap Apple Advertising
Turn off Personalized Ads

This reduces ad targeting based on your activity within Apple services.

TAX SEASON SCAMS SURGE AS FILING CONFUSION GROWS

Disabling personalized ads reduces how your behavior is used to target ads, even when your phone is idle. (Kurt “CyberGuy” Knutsson)

How to turn off personalized ads on Android

Settings may vary depending on your Android phone’s manufacturer.

Open Settings
Tap Privacy & Security or Security and privacy
Click More privacy settings
Tap Ads or Advertising
Tap Delete advertising ID or Opt out of Ads Personalization
Click Delete advertising ID

You can also reset your advertising ID from this menu to break the link between past activity and future ads.

This limits how apps and advertisers track behavior across apps and websites.

4) Consider a VPN

A reputable VPN can help obscure your IP address and reduce certain forms of network-based tracking. It does not stop all data collection, but it adds a layer of protection, especially on shared or public networks.

For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices at Cyberguy.com.

5) Remove your data from broker sites

Even if you lock down your phone, much of your personal information already exists online. Data brokers collect and sell details like your name, address, phone number and browsing behavior.

Using a reputable data removal service can help locate and remove your information from these sites. This reduces how easily advertisers and third parties can link your phone activity to your real identity.

For ongoing protection, these services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

6) Use airplane mode or power off at night

If overnight data sharing concerns you, the simplest option is also the most effective. Turning your phone off or using airplane mode cuts off wireless communication while still allowing alarms to work.

How to turn on airplane mode on iPhone

Open Control Center by swiping down from the top right corner
Tap the airplane icon so it turns orange
Confirm that cellular, Wi Fi and Bluetooth turned off

How to turn on airplane mode on Android

Settings may vary depending on your Android phone’s manufacturer.

Swipe down from the top of the screen to open Quick Settings
Tap the airplane mode icon
Check that mobile data, Wi Fi and Bluetooth are disabled

If you still want Bluetooth for a watch or headphones, you can turn it back on manually after enabling airplane mode. This keeps most background data transfers blocked while you sleep.

Take my quiz: How safe is your online security?

Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com.

Kurt’s key takeaways

Your smartphone works around the clock, even when you do not. Some background data sharing keeps your device secure and functional. Other data collection exists primarily to fuel tracking and advertising. The key is awareness and control. By tightening permissions, limiting background activity and disabling ad personalization, you reduce how much of your personal data leaves your phone while you sleep. Privacy is not about fear. It is about informed choices.

Do you leave your phone fully on overnight, or will tonight be the night you finally switch it off? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Technology

Department of Justice appeals Google search monopoly ruling

Published

19 hours ago

February 3, 2026

Press Room

Department of Justice appeals Google search monopoly ruling

On Tuesday, the Department of Justice and the plaintiffs in the antitrust case against Google filed a cross-appeal, as the DOJ Antitrust Division announced in a post on X: “Today, the DOJ Antitrust Division filed notice that it will cross-appeal from the remedies decisions in its case against Google’s unlawful monopolization of internet search and search advertising.”

Just a few weeks ago, Google itself filed a notice to appeal and requested a pause on the remedies ordered by DC District Court Judge Amit Mehta last year. Those remedies included requiring Google to share search data with its rivals and barring Google from making exclusive distribution deals for its search or AI products that could hinder distribution for competitors. However, Google was ultimately not required to sell its Chrome browser and wasn’t barred from paying distribution partners for preloading or premium placement of its search or AI products.

The DOJ’s cross-appeal suggests that neither party is fully satisfied with Judge Mehta’s ruling in the case, or at least the remedies ordered in September.