A new scam involving fake CAPTCHA boxes is tricking people into downloading malware that can steal sensitive information.