# Fake CAPTCHA Phishing and ClickFix Attacks Trick Users into Running Malware (Barracuda)

> Barracuda reports phishing campaigns that use fake CAPTCHA pages to look legitimate before harvesting Microsoft 365 credentials, pushing malware downloads, abusing browser notifications, or using ClickFix-style clipboard command injection. CAPTCHA abuse appeared in 43% of the phishing-kit attacks Barracuda examined during 2025.

- **Published:** 2026-10-15T13:43:27Z
- **Last reviewed:** 2026-10-15T13:43:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3623
- **ID:** TL-2026-3623
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Barracuda's October 2026 analysis describes phishing emails that ask recipients to review a document, invoice or contract. The link leads to a fake CAPTCHA page rather than directly to the malicious destination. The CAPTCHA serves two purposes: it lends the page legitimacy to the victim, and it acts as a gate placed between the initial link and the final destination so that automated scanners and testing tools do not reach (or see a different result from) the real payload page. After the victim passes the gate, the chain can end in a counterfeit Microsoft 365 login page for credential harvesting, a malware download, or a prompt to enable browser notifications that allow ongoing delivery of malicious content.

The ClickFix variant turns the CAPTCHA into a clipboard-injection lure. Clicking a checkbox or a Verify button, or in some variants simply moving the mouse, silently copies a malicious command to the clipboard. The page then instructs the victim to open the Windows Run dialog, paste the hidden content and execute it, so the victim runs the attacker's command themselves. Pages impersonate browser errors, failed document previews, meeting problems and software-update notices to justify the steps.

Barracuda also notes evasion and trust-building tactics: pages that adapt to the visitor's device, location, activity and timing; temporary or expiring pages that hinder investigation; and multi-brand credential chains that impersonate Adobe and then Microsoft in sequence to reinforce legitimacy. Legitimate CAPTCHAs never ask users to run commands, install software, enable browser notifications, or enter passwords or one-time passcodes.

Context from Barracuda's annual review (reported January 2026): phishing-as-a-service kits doubled in 2025 and CAPTCHA abuse featured in 43% of attacks; new kits included Sneaky 2FA, Cephas, Whisper 2FA and GhostFrame. Third-party ClickFix research (e.g. SentinelOne) reports that the pasted command typically launches PowerShell or mshta.exe to fetch a payload, commonly an infostealer such as Lumma or a remote access trojan. The Barracuda October 2026 post itself names no CVEs, malware families, network IOCs or threat actor; severity is an analyst estimate based on technique prevalence.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1598.003 Spearphishing Link
- T1204.001 Malicious Link
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1218.005 Mshta
- T1480 Execution Guardrails
- T1036 Masquerading

## Sources

- [Fake CAPTCHA attacks: How phishing campaigns are evolving (Barracuda)](https://blog.barracuda.com/2026/10/15/fake-captcha-phishing-attacks)
- [Fake CAPTCHAs are tricking users into running malware on their own devices (Help Net Security)](https://www.helpnetsecurity.com/2026/10/15/barracuda-fake-captcha-phishing-attacks/)
- [Barracuda report finds phishing kits doubled in 2025 as attacks grew more evasive (SiliconANGLE)](https://siliconangle.com/2026/01/07/barracuda-report-finds-phishing-kits-doubled-2025-attacks-grew-evasive/)
- [Threat Spotlight: The number of phishing kits doubled in 2025 (Barracuda via ITWire)](https://itwire.com/business-it-news/security/threat-spotlight-the-number-of-phishing-kits-doubled-in-2025,-bringing-stealth,-innovation-and-the-same-old-themes.html)
- [Caught in the CAPTCHA: How ClickFix is Weaponizing Verification Fatigue to Deliver RATs & Infostealers (SentinelOne)](https://www.sentinelone.com/blog/how-clickfix-is-weaponizing-verification-fatigue-to-deliver-rats-infostealers/)
- [Decoding ClickFix: Lessons from the Latest Browser-Based Phish (Varonis)](https://www.varonis.com/blog/decoding-clickfix)
- [MITRE ATT&CK T1204.004 Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3623