Deleting the fake CAPTCHA HTML is not enough. A safe recovery identifies where the script is loaded, removes malicious files and database payloads, checks users and persistence, closes the original entry point and verifies that conditional visitors no longer receive the campaign.
Why fake Google CAPTCHA malware is dangerous
Fake verification screens borrow the appearance of trusted browser or CAPTCHA products to reduce visitor suspicion. Campaigns may redirect to scams, push-notification abuse, malicious downloads or instructions that move the attack from the website into the visitor’s operating system.
What we investigate
Recovery workflow
- Capture the fake CAPTCHA behavior and the requests/scripts that build it.
- Find the server-side or database source of the loader.
- Remove malicious code and every identified persistence mechanism.
- Replace compromised components with clean trusted versions where appropriate.
- Review privileged users and rotate exposed credentials.
- Patch or remove the vulnerable entry point.
- Retest with clean sessions, devices and referrer conditions.
Important: if the fake CAPTCHA instructed visitors to paste or run commands, cleaning WordPress does not automatically remediate any visitor device that followed those instructions.
Related technical references
FAQ
What is fake CAPTCHA malware on WordPress?
It is malicious or compromised site code that displays a fake human-verification/CAPTCHA experience, often to redirect visitors, request notification permission or deliver social-engineering instructions.
Is the fake CAPTCHA really Google reCAPTCHA?
Usually no. Attackers often imitate familiar Google/reCAPTCHA branding. The injected page is controlled by the malicious campaign, not by Google.
Why can the site owner not reproduce it?
Conditional malware may target first-time visitors, mobile devices, search-engine referrers, selected countries or users without a specific cookie.
Can a security plugin remove it automatically?
A scanner may identify some files, but reliable cleanup also needs the script loader, database payload, backdoor and entry point reviewed.
What if visitors were told to paste a command?
That can indicate a ClickFix-style social-engineering flow. The website compromise and any affected visitor devices are separate security concerns and should be handled accordingly.
Can Google warnings be removed after cleanup?
After the site is genuinely clean, relevant Google Search Console or Safe Browsing review processes can be used. Google controls warning removal timing.
Fake CAPTCHA visible on your site?
Send the URL and describe who sees it — mobile, search visitors, first visit, specific countries or everyone.
Open a malware removal case