Recently, we came across a website using a new type of scam disguised as a CAPTCHA verification.
Instead of asking visitors to click a checkbox or identify images, the page instructed them to copy and paste a command into the Mac Terminal. The command looked something like this:
/bin/bash -c "$(curl ...)"
This is a major red flag.
The command downloads and runs code from a remote server without showing you what it does first. Once executed, it could install malware, steal passwords, access cryptocurrency wallets, or give an attacker remote access to your computer.
A Real CAPTCHA Will Never Ask You to Use Terminal
Legitimate CAPTCHA systems, such as Google reCAPTCHA or Cloudflare Turnstile, only require interaction within your web browser. They will never ask you to:
- Open Terminal on a Mac
- Open Command Prompt or PowerShell on Windows
- Copy and paste commands into your computer
- Download software just to prove you’re human
If a website asks you to do any of those things, close the page immediately.
What to Do If You Already Ran the Command
If you or someone on your team already pasted a command into Terminal:
- Disconnect the computer from the internet.
- Change passwords from a different, trusted device.
- Run a reputable malware scan.
- Contact your IT provider or cybersecurity professional as soon as possible.
The sooner you respond, the better your chances of limiting any damage.
Stay Skeptical
Attackers are constantly finding new ways to trick people. If a website asks you to do something that feels unusual, trust your instincts. A legitimate website should never require you to run commands on your own computer just to view its content.
When in doubt, stop and ask someone before proceeding. It could save you from a costly security incident.
If Your Website Has This, Contact Us
If your website has the CAPTCHA hack, first check by running a scan here:
- Sucuri Site Check (sitecheck.sucuri.net)
You might have this happening because your site didn’t upgrade to WordPress 7.0.2, so you should first do that along with update all plugins and themes.
Then, if you need help, reach out to our Maintenance Department. Then sign up for Website Care so you don’t have to be bothered with keeping your site up to date.
