Attackers are turning the familiar “prove you’re human” step into a gateway for malware, credential theft, and unwanted browser notifications, according to a Barracuda analysis. The vendor found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025. The checks help attackers build trust, filter visitors, and hide malicious content from automated security tools.
A typical attack starts with an email about a document, invoice, or contract. The link opens a CAPTCHA page that presents verification as a condition for viewing the content. Completing it may lead to a counterfeit Microsoft 365 login page, a malware download, or a request to enable browser notifications. Some pages imitate browser errors, failed document previews, meeting problems, or software-update notices.
In ClickFix-style attacks, users are persuaded to run malicious commands themselves. Clicking a checkbox or “Verify” button copies a command to the clipboard without the user’s knowledge, and the page instructs the person to paste it into the Windows Run dialog or another system tool. Running the command starts the infection. Barracuda said some variants copy commands after a webpage interaction or mouse movement.
Barracuda’s Poojitha B noted that pages may adapt according to a visitor’s device, location, activity, or timing, and some appear only briefly or expire after being viewed, complicating post-incident investigation. The company advises treating requests to run commands, install software, enable notifications, or provide passwords and one-time passcodes as warning signs, and checking website addresses for misspelled domains or unusual subdomains.