A new online CAPTCHA scam is quietly stealing personal information by tricking users into installing malware through fake "verify you're human" prompts.