Fake CAPTCHAs are being used to spread malware - and we only have ourselves to blame