Fake CAPTCHA pages push malware and ClickFix commands, Barracuda says
Fake CAPTCHA pages are being used to deliver malware and steal credentials, not just to hide phishing sites, according to Help Net Security, which is reporting research from Barracuda. Barracuda found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025. No CVE is involved, so this is a user-behaviour and email-security problem rather than a patching one.
What we know
Per Help Net Security’s summary of the Barracuda findings, attackers turn the familiar “prove you’re human” step into a gateway. Depending on the campaign, it leads to a malware download, a request to enable browser notifications, or a command the victim is tricked into running themselves.
- A typical chain starts with an email asking the recipient to review a document, invoice, contract or file.
- The link opens a CAPTCHA page that presents verification as a requirement for access.
- Completing it may lead to a counterfeit Microsoft 365 login page built to steal credentials.
- The checks also stop automated scanners and security testing tools from reaching the next page, which limits inspection.
Barracuda’s analyst Poojitha B said the pages may adapt to a visitor’s device, location, activity or timing, and some appear only briefly or expire after viewing, which makes them harder to investigate after an incident.
How ClickFix uses fake CAPTCHAs
Fake CAPTCHA pages also feature in ClickFix attacks, which persuade people to run malicious commands under the guise of completing verification or fixing a problem. Clicking a checkbox or a “Verify” button may silently copy a command to the clipboard. The page then tells the person to open the Windows Run dialog or another system tool, paste the text and press Enter. Running it starts the infection.
Barracuda said some variants copy the command after a webpage interaction or mouse movement. The pages may imitate browser errors, failed document previews, meeting problems or software-update notices.
Who is affected
Any organisation whose staff receive document-sharing or invoice emails is exposed. Barracuda notes that AI and no-code tools help attackers build CAPTCHA pages, login screens and phishing sequences, and that pages can include the recipient’s details or their organisation’s branding. Some campaigns chain several brands, for example a document-sharing message, then a CAPTCHA, then an Adobe-style prompt, then a Microsoft sign-in page, so the flow resembles a normal workplace process.
Specific malware families, victims and the number of affected organisations were not disclosed in the report.
Why this matters
Analysis, not new facts from the report. Because the victim runs the command or enters the password, many endpoint and mail controls see a user-initiated action. A technique that is both a scanner filter and a social-engineering step is also cheap to reuse, so expect it to keep appearing across campaigns. Treat any web page that asks a user to paste something into Run, a terminal or PowerShell as hostile.
Warning signs to watch for
Barracuda lists these requests as red flags on a CAPTCHA page:
- Run a command or paste text into a system tool.
- Install software.
- Enable browser notifications.
- Provide passwords or one-time passcodes.
What to do
- Tell staff that a real CAPTCHA never asks them to open the Run dialog, a terminal or PowerShell and paste anything. Report such pages to the security team.
- Where it fits your environment, restrict or monitor use of the Windows Run dialog and script interpreters launched from browsers; this is a suggested control, not one named in the report.
- Hunt for suspicious child processes started shortly after a user visited an unfamiliar page, and for new browser notification permissions granted to unknown sites.
- Enforce multi-factor authentication, preferably phishing-resistant, so a stolen Microsoft 365 password and passcode is less useful.
- Review reports of document-sharing emails that lead through a CAPTCHA to a sign-in page, and reset credentials for anyone who entered them.
- Block or warn on newly seen domains in your web and email gateways, since these pages can expire quickly and are hard to analyse later.
Related free tool: test how long a password would take to crack with our Password Strength Checker. It runs entirely in your browser and nothing you type is sent or stored.
