

Oooo I’m researching this. We call some of them click fix and others clearfake but theyre all fake captcha. Its either from vulnerable wordpress themes or plugins so update ya sites for the love of Torvalds.
They’re basically a method for infostealers to get downloaded onto the device. They’re kinda nasty and some lead to ransomware if youre really unlucky. The usual payload is intended to leach off an individual and steal passwords, crypto addresses, etc, but as soon as they find out you’re an organisation computer, they use your machine for initial access and potential further compromise.
Most people don’t run these but I’ve seen at least 3 people who have and tbh usually antivirus stops the 2nd stage payload. So make sure Defender antivirus is turned on, and maybe consider blocking newly registered domains using ad block if you are more tech savvy. Remind your grandparents and young siblings to never do anything with Win+R or disable it on their pc if you know how. Infostealers are nasty and having one on the family pc will hurt every member of the family.
Yeah, some wordpress themes have vulnerable bits that allow attackers to inject cross site scripting attacks into the page via various methods. Some have pivoted to using wordpress plugins which is a newer method I don’t entirely understand yet.