Fake CAPTCHAs Trick People Into Installing Malware

Fake CAPTCHA pages are turning a familiar security check into a way to steal passwords, deliver malware and enable unwanted browser notifications. The danger is especially high when a page tells you to paste a command into Windows, because following those instructions can infect the computer.

According to Help Net Security, Barracuda found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025.

What happened

Attackers are placing convincing CAPTCHA screens between an email link and the real attack. A message may claim that a document, invoice, contract or shared file is waiting. After the recipient completes the supposed verification, the site may display a fake Microsoft 365 sign-in page, start a malware download or request permission to send browser notifications.

Some pages use a method known as ClickFix. Clicking a checkbox or Verify button may secretly copy a command to the computer’s clipboard. The page then tells the person to open the Windows Run box or another system tool, paste the command and press Enter. That final action launches the malware, according to the report.

The pages may also imitate broken document previews, browser errors, meeting problems or software-update warnings. Some adjust their appearance based on the visitor’s device, location or activity, while others disappear quickly. Artificial intelligence and no-code tools can help criminals personalize the pages with a recipient’s details or an employer’s branding.

Who is affected

Anyone who opens unexpected document or account links can encounter this scam, including home users and workers at small offices. A normal CAPTCHA may ask you to identify pictures or check a box, but it should not require you to open Windows Run, paste a command, install software, reveal a password or one-time code, or allow browser notifications.

Misspelled domains, unrelated web addresses, surprise downloads and threats of account suspension or data loss are additional warning signs identified in the report.

What to do now

1. If a CAPTCHA asks you to open a system tool, paste text or install anything, close the tab. Do not press Enter, even if the page claims that the step will fix an error or unlock a file.

2. Before signing in, inspect the address bar. Instead of trusting the page’s link, open a new tab and type the service’s known address yourself. Contact the sender through a separate channel if an unexpected invoice or document may be legitimate.

3. If you allowed notifications, open your browser’s Settings, find Site settings or Notifications, and remove or block the unfamiliar site. Do not click the alerts it has already sent.

4. If a file downloaded or you ran a pasted command, disconnect the computer from the internet. Open your installed security software and select its full or complete scan option. Avoid signing in to important accounts on that device until the scan is finished.

5. If you entered a password, use a clean device to visit the real account site, change that password and review active sessions. Change any other account using the same password, then turn on two-factor authentication where available.