Fake CAPTCHA Attacks Evolve to Hide Malware and Trigger ClickFix Infections
Summary
Barracuda says CAPTCHA abuse appeared in 43% of phishing-kit attacks it examined in 2025. Fake challenges can hide malicious pages from scanners, profile visitors, steal credentials, deliver malware, or trick users into running commands.
Key points
- Barracuda analysis found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025.
- Fake CAPTCHA pages can screen out automated scanners and adapt to a visitor’s device, location, activity, or timing.
- Campaigns may use CAPTCHA pages to lead users to credential-harvesting sites, malware downloads, or browser-notification prompts.
- ClickFix variants may copy a malicious command to the clipboard and instruct users to paste it into Windows Run or another system tool.
- Barracuda recommends pausing at unexpected verification prompts, checking links through a trusted channel, and never running commands or installing software at a webpage’s request.
- The article also recommends layered defenses such as multifactor authentication, email and URL analysis, endpoint security, and threat intelligence.
Article Details
- Event Type
- Barracuda reports the evolution of fake CAPTCHA abuse in phishing campaigns, including its use to profile victims, evade automated security tools, harvest credentials, deliver malware, abuse browser notifications, and facilitate ClickFix attacks.
- Impact
- Fake CAPTCHAs can make malicious journeys appear legitimate and conceal harmful content. Victims may disclose credentials, enable browser notifications, download malware, or execute malicious commands themselves. Barracuda found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025.
MITRE ATT&CK
T1056.003 · Web Portal CaptureSome campaigns use counterfeit Microsoft 365 login pages to harvest credentials.T1059 · Command and Scripting InterpreterIn ClickFix attacks, victims are instructed to paste and execute a concealed malicious command using Windows Run or another system tool.T1204.004 · Malicious Copy and PasteVictims may be instructed to enable browser notifications, allowing attackers to continue delivering malicious content.T1566.002 · Spearphishing LinkThe article describes phishing messages containing links that lead recipients through fake CAPTCHA pages.