Thousands of hacked sites trick you into installing malware

You land on the real website of a local business and a CAPTCHA appears.

It looks routine until the page tells you to open Windows Run and paste a command.

That should stop you cold.

Security researchers say thousands of legitimate small-business websites have been compromised to spread this malware trap.

Here's what to know before a familiar website catches you off guard.

NE W! Join our upcoming CyberGuy LIVE class: Get Better Health Care With AI In this free live online class, Kurt "CyberGuy" Knutsson will show you five practical ways AI can help you take a more active role in your health care.

You’ll learn how to organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare questions for your next doctor’s visit.

No technical experience is needed.

Register for free now at CyberGuyLive.com FAKE PATIENT PORTAL SCAM CAN STEAL YOUR LOGIN AND INFECT YOUR PC This campaign is much bigger than a handful of infected pages.

Netskope Threat Labs says it identified more than 5,400 compromised websites across more than 2,200 organizations worldwide over the past few months.

The sites have little in common beyond many belonging to small businesses.

Researchers found clinics, plumbing companies, online stores and other businesses among the victims.

Where Netskope examined individual sites, they most often ran WordPress and sometimes PrestaShop.

Researchers still do not know how attackers initially compromised them.