Threat reportPhishingTL-2026-3623
Fake CAPTCHA Phishing and ClickFix Attacks Trick Users into Running Malware (Barracuda)
Fake CAPTCHA Phishing and ClickFix Attacks Trick Users into (TL-2026-3623), also tracked as Fake CAPTCHA phishing, is a medium-severity phishing campaign, first published 2026-10-15. It has no confirmed attribution, affects Microsoft Microsoft 365 (credential impersonation target) / Windows, maps to 8 MITRE ATT&CK techniques (T1036, T1059.001, T1204.001), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3623
- Threat ID
- TL-2026-3623
- Also known as
- Fake CAPTCHA phishing, ClickFix, CAPTCHA-gated phishing
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- enterprise, business services, general
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Fake CAPTCHA Phishing and ClickFix Attacks Trick Users into
Malware and tooling: Lumma Stealer - S1213, Barracuda, Cephas, GhostFrame, Sneaky 2FA, Whisper 2FA
How Fake CAPTCHA Phishing and ClickFix Attacks Trick Users into works
Barracuda reports phishing campaigns that use fake CAPTCHA pages to look legitimate before harvesting Microsoft 365 credentials, pushing malware downloads, abusing browser notifications, or using ClickFix-style clipboard command injection. CAPTCHA abuse appeared in 43% of the phishing-kit attacks Barracuda examined during 2025.
Barracuda's October 2026 analysis describes phishing emails that ask recipients to review a document, invoice or contract. The link leads to a fake CAPTCHA page rather than directly to the malicious destination. The CAPTCHA serves two purposes: it lends the page legitimacy to the victim, and it acts as a gate placed between the initial link and the final destination so that automated scanners and testing tools do not reach (or see a different result from) the real payload page. After the victim passes the gate, the chain can end in a counterfeit Microsoft 365 login page for credential harvesting, a malware download, or a prompt to enable browser notifications that allow ongoing delivery of malicious content.
The ClickFix variant turns the CAPTCHA into a clipboard-injection lure. Clicking a checkbox or a Verify button, or in some variants simply moving the mouse, silently copies a malicious command to the clipboard. The page then instructs the victim to open the Windows Run dialog, paste the hidden content and execute it, so the victim runs the attacker's command themselves. Pages impersonate browser errors, failed document previews, meeting problems and software-update notices to justify the steps.
Barracuda also notes evasion and trust-building tactics: pages that adapt to the visitor's device, location, activity and timing; temporary or expiring pages that hinder investigation; and multi-brand credential chains that impersonate Adobe and then Microsoft in sequence to reinforce legitimacy. Legitimate CAPTCHAs never ask users to run commands, install software, enable browser notifications, or enter passwords or one-time passcodes.
Context from Barracuda's annual review (reported January 2026): phishing-as-a-service kits doubled in 2025 and CAPTCHA abuse featured in 43% of attacks; new kits included Sneaky 2FA, Cephas, Whisper 2FA and GhostFrame. Third-party ClickFix research (e.g. SentinelOne) reports that the pasted command typically launches PowerShell or mshta.exe to fetch a payload, commonly an infostealer such as Lumma or a remote access trojan. The Barracuda October 2026 post itself names no CVEs, malware families, network IOCs or threat actor; severity is an analyst estimate based on technique prevalence.
MITRE ATT&CK techniques used in TL-2026-3623
Defense Evasion
T1036 Masquerading; T1218.005 Mshta; T1480 Execution Guardrails
Execution
T1059.001 PowerShell; T1204.001 Malicious Link; T1204.004 Malicious Copy and Paste
Initial Access
Reconnaissance
Affected products and versions in Fake CAPTCHA Phishing and ClickFix Attacks Trick Users into
Remediation for Fake CAPTCHA Phishing and ClickFix Attacks Trick Users into
Immediate actions
- Alert users that legitimate CAPTCHAs never ask them to open the Run dialog, paste commands, install software, enable browser notifications, or enter passwords or one-time passcodes
- Hunt for powershell.exe or mshta.exe launched shortly after a browser session on endpoints, especially when the parent is explorer.exe following a Run dialog execution
- Review and revoke unexpected browser notification permissions granted to unfamiliar sites
- Reset credentials and revoke sessions for users who entered credentials on a page reached through a CAPTCHA
Workarounds
- Block or restrict browser notification prompts via enterprise browser policy
- Use application control to limit mshta.exe and PowerShell execution from user-initiated Run dialog sessions
Longer-term hardening
- Deploy layered email protection, URL analysis, endpoint security and threat intelligence
- Evaluate the complete interaction chain rather than the presence of a CAPTCHA alone
- Enforce multifactor authentication, preferably phishing-resistant
- Train employees to recognise abnormal verification requests and verify URLs and sources through separate trusted channels
- Consider restricting the Windows Run dialog and constraining PowerShell and mshta.exe where business needs allow
Timeline of Fake CAPTCHA Phishing and ClickFix Attacks Trick Users into
- ClickFix social-engineering technique (clipboard command pasted into the Windows Run dialog) was named by Proofpoint researchers in 2024 (exact date not stated in sources).
- Close of the 2025 period in which Barracuda observed CAPTCHA abuse in 43% of the phishing-kit attacks it examined; phishing-as-a-service kits doubled during the year.
- Barracuda's annual threat review reported phishing kits doubled in 2025 and named new kits Sneaky 2FA, Cephas, Whisper 2FA and GhostFrame.
- Barracuda's fake CAPTCHA phishing analysis carries an October 8, 2026 date in the source metadata.
- Help Net Security published coverage of the Barracuda findings.
- Barracuda blog 'Fake CAPTCHA attacks: How phishing campaigns are evolving' published, describing credential harvesting, malware downloads, notification abuse and ClickFix chains.
Sources cited for Fake CAPTCHA Phishing and ClickFix Attacks Trick Users into
- Fake CAPTCHA attacks: How phishing campaigns are evolving (Barracuda)
- Fake CAPTCHAs are tricking users into running malware on their own devices (Help Net Security)
- Barracuda report finds phishing kits doubled in 2025 as attacks grew more evasive (SiliconANGLE)
- Threat Spotlight: The number of phishing kits doubled in 2025 (Barracuda via ITWire)
- Caught in the CAPTCHA: How ClickFix is Weaponizing Verification Fatigue to Deliver RATs & Infostealers (SentinelOne)
- Decoding ClickFix: Lessons from the Latest Browser-Based Phish (Varonis)
- MITRE ATT&CK T1204.004 Malicious Copy and Paste
Detection coverage for TL-2026-3623
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3623 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.