Fake CAPTCHA on Your Website: The Hack Your Customers See and You Never Will

The phone call usually starts politely. A customer is ringing about an enquiry and, almost as an afterthought, mentions that your website asked them to prove they were human by pressing the Windows key and R, then pasting something in. They did not do it. They thought you should know.

Consider how this plays out for a typical small firm. What follows is a composite, built from the pattern government cyber agencies have described all year, not one specific business. A Monaghan furniture maker who takes commissions through a WordPress site gets that call from a retired teacher planning a dresser for her kitchen. The owner opens the website on the office laptop. Homepage, gallery, contact form. Everything looks exactly as it should, so the owner thanks the caller, puts it down to a scam email or a browser glitch, and goes back to the workshop.

That conclusion is wrong. And the website was rigged to produce it.

Why the Owner Is the Last Person Who Can See It

Most of our morning operations review comes down to one question: what does the production environment look like to someone who is not us? This attack lives in the gap between those two views.

Security researchers at Rapid7 documented a campaign in March 2026 that had injected fake Cloudflare verification boxes into more than 250 websites across at least 12 countries, the UK among them, ranging from regional news outlets to local businesses ^[4]. The injected script checks for WordPress login cookies before it does anything. If you are logged in, as most owners are on their own laptop, it stays silent. A second variant also skips visitors that look like search engine crawlers or bots. The box itself was designed to appear roughly once a month per visitor, not on every page.

In practice, the three checks a careful owner would make all come back clean:

• You visit the site yourself. You are logged in, so the script sleeps.
• You look at your Google listing. Crawlers are served a normal page, so your search result looks the same as yesterday.
• You run an online scanner. New Zealand's National Cyber Security Centre warned in September 2026 that this behaviour affects real browsers only, while scanners and search-engine crawlers see a clean page ^[3].

The furniture maker did everything a reasonable person would do. Whoever compromised the site had anticipated every one of those steps.

What Your Customer Was Actually Being Asked to Do

The technique is known as ClickFix, and Microsoft's threat intelligence team has analysed it in detail ^[1]. A visitor lands on a page that looks like a familiar verification check. When they click the box, the page quietly copies a command onto their clipboard. The on-screen instructions then walk them through opening the Windows Run dialog, pasting, and pressing Enter. That is the entire trick. The visitor installs the malware themselves.

Microsoft reports that campaigns using this approach reach thousands of business and home devices around the world every day, and that the most common final payload it observed was an information stealer, malware built to harvest logins and data from the infected computer ^[1]. Rapid7's analysis of the WordPress campaign found its stealer collecting passwords saved in browsers, cookies and cryptocurrency wallets ^[4]. Because a person launches the command by hand, it slips past many of the automated defences that would stop an ordinary malicious download.

Think about the retired teacher for a moment. Her email, her online banking, the card details saved in her browser. Had she followed the instructions, all of it could have left her machine that afternoon, and the trail would lead back to a visit to your website.

The Scale Behind One Phone Call

This is not a niche problem. Switzerland's National Cyber Security Centre said in August 2026 that more than 100,000 websites worldwide had already been affected, most of them running WordPress, many compromised through security flaws their owners had not yet patched ^[2]. Treat that as an order of magnitude rather than a precise count: it comes from one agency's view of a campaign that changes week to week, and the true number could be well above or below it. Nobody chose the furniture maker. The attackers chose every site that was reachable and behind on updates.

How to Verify It From the Outside

When a customer reports something odd on your site, treat it as a credible signal until you have proved otherwise. Saying you checked and it looks fine proves nothing here, for all the reasons above.

Verify the way a stranger would see it:

1. Log out completely, or better, use a browser you never use for WordPress admin.
2. Open a private or incognito window, so no saved cookies mark you as a returning visitor.
3. Switch to your phone on mobile data, with Wi-Fi off. The NZ alert specifically recommends testing from different IP addresses and on both mobile and desktop ^[3].
4. Ask the customer for a screenshot and the exact page address. Most people are glad to help once they see you are taking it seriously.
5. Ask someone on a Windows laptop to load a few pages for you. Some variants only target Windows or macOS browsers ^[3].

There is one limitation you have to be honest with yourself about. Because the box is built to show only occasionally, a clean test does not clear the site. You can follow every step above, see nothing, and still be compromised. If a customer describes a fake verification box in believable detail on your web address, act on their report rather than on your own failure to reproduce it.

The First Hour: Five Steps to Contain a Fake CAPTCHA

Most guides jump straight to cleaning the malware. Cleaning matters, and it is in the list below. The first priority, though, is that your website stops harming the people who trust it.

1. Contain. Take the production environment offline or put it into maintenance mode until it is clean. A day without enquiries costs far less than one customer's emptied bank account with your business name attached to it.
2. Rotate. Change every WordPress administrator password, your hosting account password and the email account used to reset them, working from a device you trust. Rapid7 notes that the entry point in these campaigns is not always confirmed, and stolen or guessed admin logins are among the possibilities ^[4].
3. Notify. Tell your customers plainly what happened. The wording is covered in the next section.
4. Trace. Find out how the attacker got in before you bring the site back. The NZ alert is blunt on this: removing the prompt is not enough, and owners must identify the original route in and remove anything that would reinfect the site ^[3].
5. Restore and verify. Roll back to a clean backup taken before the compromise, apply every pending update, then verify from outside: logged out, private window, mobile data.

Choosing that restore point is where a proper WordPress security and backup routine earns its keep, because you need a copy old enough to predate the injection. Tracing is where most repeat infections start, and the full cleanup order in our guide to why websites get hacked again after cleaning applies directly here.

What to Say to Your Customers

This is the step owners skip, because it feels like admitting fault. It is the opposite. A short, honest notice protects people who may have followed the instructions and do not yet realise it.

The NZ National Cyber Security Centre suggests site owners tell visitors not to run anything copied to their clipboard and, if they already have, to run a security scan and reset their passwords ^[3]. Adapted for a small business, a notice on your homepage and a short email to recent enquirers could read:

For a short period, some visitors to our website may have seen a fake "verify you are human" box asking them to press keys and paste a command. It did not come from us. If you followed those steps, please run a full antivirus scan and change the passwords saved in your browser, starting with email and banking. The site has been cleaned and our logins changed. Contact us directly with any questions.

Keep it factual. Do not guess at who was behind it.

There is a second, separate question. If the attacker had administrator access, they may also have been able to see enquiries, orders or contact details stored on the site. That may amount to a personal data breach under GDPR, which generally gives you 72 hours from becoming aware of it to notify the Data Protection Commission where people are likely to be put at risk. Whether that applies depends on what the site held and what the attacker could reach, so take advice from your solicitor or data protection adviser early rather than late.

What Your Hosting Should Be Doing Before Anyone Rings

Some of this sits with you. A great deal of it does not. It lives at server level, and it depends on whether anyone is actually operating the platform your site runs on.

A host that takes this seriously should be able to show you five things:

• Server-level hardening, so one vulnerable plugin gives an attacker less room to move once it is exploited.
• Intrusion prevention that blocks repeated login attempts, closing off the guessed-password route in.
• Automatic malware scanning of site files, so injected code can be flagged without waiting for a customer to ring.
• Nightly backups with real restore points, so the rollback in step five exists and is recent.
• People you can actually reach, who will look at your site the same day rather than leaving a ticket in a queue.

Without that last one, the furniture maker spends the afternoon after the phone call searching forums while the infected site keeps serving the trap to whoever lands on it next.

Web60 is built to meet that standard. Every site runs on Irish infrastructure with server-level security hardening, fail2ban intrusion prevention and automatic malware scanning, and you can read how the platform is hardened and monitored in plain terms before you decide anything.

Nightly backups come with one-click restore, and a safety snapshot is taken automatically before any restore, so rolling back does not wipe the state you may need to investigate. When something looks wrong, you talk to our Irish support team, real people who will look at the production environment with you. If your current host cannot answer for those five points, our free migration service will move an existing site across, and the €60 a year covers all of it.

Where Scanning Stops

No scanner protects a visitor who decides to paste a command a website tells them to. Part of the code in these campaigns is fetched from outside your server at the moment of the visit, and the Swiss NCSC notes some of it is stored on a blockchain ^[2], so a file scan on your server may only find a small loader. Scanning, hardening and fast restores shrink the window an attacker has. Keeping WordPress, themes and plugins updated closes the door these campaigns use most. Both matter, and neither replaces the other.

When a Bigger Security Operation Makes Sense

If you run a high-volume online shop with its own security staff and payment flows that attract targeted attacks, an enterprise managed host with a dedicated security operations team, contractual incident response times and bot management in front of the site is genuinely the better fit, and its pricing reflects that. That is a real category of business. It is not a furniture maker handling a few commission enquiries a week, or most of the local firms whose sites are being used in this campaign.

What to Do With the Next Strange Phone Call

The fake verification box is designed around one assumption: that you will check your own site as yourself, see nothing, and move on. Everything about it, from hiding behind your login cookie to appearing about once a month, depends on that.

So change the habit. When a customer says something on your site looked strange, believe them first and verify from a stranger's seat second. Logged out. Private window. Phone on mobile data. If the box is there, contain it, tell people plainly, and find the way in before you reopen.

Running your own WordPress site means you can do all of that within the hour, without waiting for an agency to log in. The customer who rang did you a real favour. Your job now is to make sure the next visitor never sees what they saw.

Frequently Asked Questions

What does a fake CAPTCHA on a hacked website look like?

It usually imitates the familiar Cloudflare verification check, often as a full-screen box that appears a moment after the page loads. The giveaway is the instruction that follows the click: press the Windows key and R, paste, and press Enter, or the Mac equivalent using Terminal. A genuine human check never asks you to open a command window or paste anything.

Why can I not see the fake CAPTCHA on my own website?

Because it is designed to hide from you. Researchers at Rapid7 found the injected script checks for WordPress login cookies and stays silent for logged-in users, skips visitors that look like search engines or scanners, and was designed to appear only about once a month per visitor. Test logged out, in a private window, and on a phone using mobile data.

If a customer saw a fake verification box, is my website definitely hacked?

Not definitely, because the customer could have reached a different site through a bad link or advert. Treat it as a credible report, though. Ask for a screenshot and the exact page, then verify from a logged-out device on a different network. If the box appeared on your own web address, assume the site is compromised and contain it until it is cleaned.

Would a real website security check ever ask me to run a command?

No. Switzerland's National Cyber Security Centre puts it simply: never run a computer command, such as pressing the Windows key and R, because a website tells you to. Genuine checks either pass on their own or ask you to tick a box. Leave any site that asks for more.

What should a customer do if they followed the fake CAPTCHA instructions?

Run a full scan with up-to-date security software, then change the passwords saved in their browser from a different, trusted device, starting with email and banking. They should turn on two-step verification where their accounts offer it and watch bank statements closely. If the computer is used for work, they should tell whoever manages it straight away.

Do I have to report a hacked website in Ireland?

It depends on what the attacker could reach. If they had administrator access to a site holding customer enquiries, orders or contact details, it may be a personal data breach under GDPR. Where a breach is likely to put people at risk, the Data Protection Commission must generally be notified within 72 hours of you becoming aware of it. Take advice from your solicitor or data protection adviser early.

Sources