Fake CAPTCHA scams trick users into opening command windows and pasting malicious scripts, installing StealC malware that steals passwords silently.