Fake CAPTCHAs are tricking users into running malware on their own devices
Barracuda found fake CAPTCHAs in 43% of 2025 phishing-kit attacks, including ClickFix malware lures.
3
Stories per day · 30 days
5 RSS
12 stories, newest first · one card per story
Stories tagged #fake-captcha
ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache
ClickFix sites hide VBScript in the browser cache and trick users into running it.
13
Microsoft Warns ClickFix Attacks Use Fake CAPTCHA Lures to Execute Malicious Commands
Microsoft warns a ClickFix campaign uses fake CAPTCHA prompts so Windows users run cached malware that steals browser credentials.
15
Malicious Custom GPT on chatgpt.com lures users into installing a RAT
Malicious ChatGPT Custom GPTs promoted via sponsored Google results push a ClickFix fake-CAPTCHA lure that sideloads a RAT via signed executables.
ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer
Attackers hijacked Ukrainian sites with a fake Cloudflare CAPTCHA to install Psychedelic Stealer and steal credentials.
2
Criminals turn placeholder domain into ClickFix trap
Attackers registered documentation placeholder domain third-party.com and used it to serve Windows users a ClickFix fake-CAPTCHA page pushing a PowerShell downloader.
1
The Domains Keep Disappearing, but the Malware Infrastructure Behind Them Never Moves
ActiveSOC found fake-CAPTCHA malware lures rotating domains while Seychelles hosting infrastructure stayed put.
2
Hackers Hide Malware Servers on Blockchain to Steal Bank Logins and 2FA Codes
Malware operators hide C2 in Polygon blockchain contracts via EtherHiding, delivering a browser-based banking trojan that steals bank logins and 2FA codes from 479 sites.
3
ClickFix attacks are tricking Mac and Windows users into hacking themselves
ClickFix campaigns trick users into pasting terminal commands via fake CAPTCHAs; latest wave abused HBO Max's hacked Reddit account to push infostealer ads.
2
TerminalFix looks like ClickFix, but delivers a very different payload
Malwarebytes warns TerminalFix mimics the ClickFix fake CAPTCHA social engineering trick but delivers a payload granting attackers access to victims' wider network.
1
TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse
Microsoft details TerminalFix, a ClickFix variant using fake Cloudflare CAPTCHAs to make users run PowerShell payloads with reverse-tunnel implants.
3
StopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal Network
Check Point uncovered StopAndProtect, a cybercrime operation using ~2,000 hacked WordPress sites for ClickFix-driven malware delivery, data theft, surveillance, and ransomware.
1