Fake CAPTCHA pages are spreading malware through changing domains, using copied commands and Windows Run to trigger infections.