Fake CAPTCHA pages keep scanners out and get victims to run the malware themselves
Barracuda found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025. The check can keep automated scanners from reaching the next page, so a URL scan may inspect only the CAPTCHA.
The Watch · Security desk
What happened
- The lure starts as an email about a document, invoice, contract or file, and the link opens a CAPTCHA page that presents verification as a requirement for access.
- Completing the check can lead to a counterfeit Microsoft 365 login page, a malware download or a prompt to enable browser notifications.
- In ClickFix attacks, a checkbox or Verify button copies a command to the clipboard, and the page tells the victim to paste it into the Windows Run dialog and press Enter.
- Some campaigns chain impersonations, moving from a document-sharing message to a CAPTCHA, an Adobe-style prompt and then a Microsoft sign-in page.
Why it matters
- decision URL reputation and sandbox detonation alone leave a gap at the CAPTCHA, so teams need a second layer on the endpoint where a pasted command runs and in browser notification permissions.
- constraint Responders may reach a user report after the page has expired, leaving them less to inspect than the victim saw.
- capability AI and no-code tools let attackers put the recipient's details and the organization's branding on CAPTCHA pages, login screens and whole phishing sequences.
This is a technique, so nothing is patchable and no deadline applies. What can be measured is prevalence, and Barracuda's 43% is a large minority of the phishing-kit attacks it examined during 2025 [1]. The company did not disclose how many attacks that covers, so it is one vendor's sample.
Barracuda says the check helps attackers gain trust, filter visitors and conceal content from automated security tools [2]. Poojitha B, a Threat Analysis Associate at Barracuda, said: "The pages may also adapt according to a visitor's device, location, activity, or timing." [6] In our view that makes a clean verdict on a link weak evidence. The scanner may have been shown something different from what the target saw.
ClickFix variants add a detail that matters for detection. Barracuda said some copy the command after a webpage interaction or mouse movement [9], so the copy step can fire without a click on the checkbox. The pages pose as browser errors, failed document previews, meeting problems or software-update notices [10].
The page content is cheap to vary. Barracuda describes AI and no-code tools being used to build the CAPTCHA pages, login screens and phishing sequences, with the recipient's details or the organization's branding worked in [11].
Barracuda's advice is aimed at users. It treats any page asking the user to execute a command, install a program, turn on browser notifications, or hand over a password or one-time code as a warning sign [13], and it says to check addresses for misspelled domains, unusual subdomains and addresses unrelated to the service shown [14].
What to watch
- Whether Barracuda publishes the number of attacks behind the 43%, so the figure can be compared with other vendors' counts.
- Whether more ClickFix variants trigger the clipboard copy on mouse movement or other passive interaction instead of a click.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption43
- Hype gap+10
- Incentives40
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Barracuda found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025.
- [2]
Fake CAPTCHA checks help attackers gain users' trust, filter visitors, and conceal malicious content from automated security tools.
- [3]
An attack may begin with an email asking the recipient to review a document, invoice, contract or file; the link opens a CAPTCHA page that presents verification as a requirement for accessing the content.
- [4]
Completing the check may lead to a counterfeit Microsoft 365 login page designed to steal credentials; other campaigns trigger malware downloads or ask users to enable browser notifications, allowing attackers to send further malicious content.
- [5]
CAPTCHA challenges can prevent automated scanners and security testing tools from reaching the next page, limiting inspection of the attack.
- [6]
"The pages may also adapt according to a visitor's device, location, activity, or timing."
- [7]
Some fake CAPTCHA pages appear only briefly or expire after being viewed, making them more difficult for security teams to investigate after an incident.
- [8]
In ClickFix attacks, clicking a checkbox or Verify button may copy a command to the clipboard without the user's knowledge; the page then tells the person to open the Windows Run dialog or another system tool, paste the text and press Enter, and running the command starts the infection.
- [9]
Barracuda said some ClickFix variants copy commands following a webpage interaction or mouse movement.
- [10]
Fake CAPTCHA pages may imitate browser errors, failed document previews, meeting problems or software-update notices.
- [11]
AI and no-code development tools help attackers create CAPTCHA pages, login screens and phishing sequences; pages can incorporate the recipient's details or their organization's branding.
- [12]
Some campaigns impersonate several services in sequence: a document-sharing message may lead to a CAPTCHA, an Adobe-style prompt and a Microsoft sign-in page.
- [13]
Requests to run commands, install software, enable browser notifications, or provide passwords and one-time passcodes are warning signs of a fake CAPTCHA; unexpected downloads and threats of account suspension or data loss should also prompt users to stop.
- [14]
Barracuda advises checking website addresses for misspelled domains, unusual subdomains, and addresses unrelated to the service being presented.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- helpnetsecurity.comFake CAPTCHAs are tricking users into running malware on their own devices
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.