Fake CAPTCHA Attacks Turn Familiar Security Checks Into Malware Traps

A familiar security check becomes a route to infection

Fake CAPTCHA attacks are turning a routine online security check into a way to steal passwords, financial information and corporate data. Instead of simply asking visitors to identify letters or select pictures, fraudulent pages tell them to run commands on their computers. Following those instructions can install malware such as Lumma Stealer.

By June 23, 2025, the technique known as ClickFix had been detected across multiple client environments by Japanese security firm LAC. The firm reported incidents beginning in late 2024 and a marked increase in 2025. Attacks have also been reported in the United States, Europe and Asia, affecting individuals and organisations in telecommunications, healthcare, finance and hospitality.

Gen Digital, the parent company of Norton and Avast, said phishing and malware attacks using fake CAPTCHAs increased by more than 600% in Japan in 2024. The total reported damages from such attacks have reached hundreds of millions of dollars. Those figures describe a threat that combines familiar website design with instructions that move the attack onto the visitor's own device.

CAPTCHA systems normally help websites distinguish humans from automated programs, known as bots. They protect against spam, automated abuse and credential stuffing, in which attackers try stolen login details against other accounts. Their familiar appearance gives criminals a useful disguise: a security screen that users expect to encounter and may follow without much hesitation.

The central warning is straightforward. A legitimate CAPTCHA never asks someone to open the Windows Run dialog, paste commands into a terminal or execute code to prove they are human. When a page makes that request, the apparent security check has become an instruction to give software access to the computer.

How ClickFix turns verification into command execution

ClickFix is a social engineering technique, meaning it manipulates a person's decisions rather than relying solely on a flaw in software. Criminals present a task as something the user must complete to fix a problem or continue. In fake CAPTCHA campaigns, that task is disguised as verification.

A victim typically reaches the page through a phishing email, a malicious advertisement or a legitimate website that has been compromised. Phishing messages impersonate a trusted organisation to persuade recipients to follow a link or take another action. The destination then displays a counterfeit CAPTCHA resembling Google's reCAPTCHA or Cloudflare's challenge screens.

The forged page first asks the visitor to prove they are not a robot. After the visitor interacts with it, further instructions appear. Those instructions can tell the person to copy and paste a command into the computer's Run dialog or terminal. Carrying them out executes malicious code.

On Windows, a common sequence asks the user to press the Windows key and R, paste a command, then press Enter. The command may invoke PowerShell or mshta.exe. PowerShell is a command and scripting tool; mshta.exe is a Windows utility that can execute scripts. Attackers use these tools to download and run malicious software.

Unlike an attack that depends on exploiting a software vulnerability or persuading someone to download an infected file, ClickFix gets the victim to launch the command directly. The instructions look like small steps in an ordinary verification process, while their actual effect is to begin installing malware such as Lumma Stealer, AsyncRAT or another trojan that steals information.

Why convincing instructions can overcome suspicion

Google and Cloudflare challenge screens are familiar to many internet users. Criminals imitate their appearance because familiarity encourages trust. A visitor may recognise the design and focus on finishing the task rather than examining why a website is asking for access to a computer's command tools.

Frequent security checks can also create authentication fatigue. People who repeatedly encounter CAPTCHAs may become less attentive to each one. A forged screen takes advantage of that routine by presenting its instructions as another small obstacle between the user and the page they want to reach.

Step by step directions reduce the apparent complexity of the request. Opening a dialog, pasting text and pressing Enter can feel like completing a checklist. The dangerous part is the purpose of the pasted text: it tells the computer to retrieve and execute code controlled by the attacker.

Endpoint security tools, which monitor individual computers, can face a harder task when the user starts the command. Because the action appears to come from the person using the device, a security product may interpret it as legitimate. This makes a combination of technical protection and informed users necessary.

Even experienced users can encounter convincing forgeries. A recognisable logo or familiar challenge design offers reassurance, while the request to use a system command is the clearest warning that the process has departed from normal CAPTCHA verification.

Booking pages, search results and trusted websites become lures

Booking.com impersonation has been used to draw victims into fake CAPTCHA attacks. Criminals sent phishing emails leading to a counterfeit booking page, where a fraudulent verification screen instructed visitors to take the steps that installed malware. The resulting infections stole credentials and personal data.

Malicious advertisements and manipulated search results provide another route. Attackers use search engine optimisation techniques, known as SEO, to push fake download sites into prominent positions. Pages promising popular software, music or movies can display a fake CAPTCHA before delivering an infection.

Compromised legitimate websites can also serve the fraudulent popups. A visitor may have good reason to trust the website itself, yet still encounter content inserted by an attacker. The instructions shown by the challenge therefore matter even when the surrounding site looks familiar.

LAC's observations place the rise in ClickFix incidents across late 2024 and 2025. Lumma Stealer, one of the malware families delivered through these attacks, had already emerged in 2022. The chronology shows how an established information stealing tool became part of a growing method for persuading people to infect their own devices.

• 2022: Lumma Stealer emerged and became available to criminals.
• 2024: Gen Digital recorded an increase of more than 600% in phishing and malware attacks using fake CAPTCHAs in Japan.
• Late 2024: LAC began detecting ClickFix incidents across multiple client environments.
• 2025: LAC reported a marked increase in those attacks.

What Lumma Stealer takes from an infected device

Lumma Stealer is an infostealer, a type of malware designed to collect information from a computer and send it to criminals. Since its emergence in 2022, it has rapidly gained popularity among attackers and is sold through dark web forums and Telegram channels.

The software is offered through a model called Malware as a Service, or MaaS. Criminals can obtain access to an existing malicious tool rather than build one themselves. That makes Lumma available to a wide range of attackers who can combine it with phishing messages, fraudulent websites and ClickFix instructions.

Once installed, Lumma can harvest passwords and cookies stored in browsers. Cookies are small pieces of data websites use to remember visitors and their sessions. Their theft, alongside stolen passwords, places online accounts and sensitive information at risk.

Lumma can also steal cryptocurrency wallet credentials, including those associated with MetaMask and Binance. It can extract two factor authentication data and browser extensions, collect system and application information, obtain remote desktop credentials, and send files and other sensitive data to servers controlled by attackers.

Other malware families observed in these campaigns include AsyncRAT, Vidar Stealer and XWorm, as well as various remote access trojans. A remote access trojan, or RAT, gives an attacker a way to access an infected machine from elsewhere. The same fake verification process can therefore lead to different forms of theft or remote access.

The download chain hides behind ordinary files and tools

A fake CAPTCHA infection usually begins in the browser but continues through the computer's command tools. After arriving through a phishing link or malicious advertisement, the visitor sees a challenge and is prompted to execute a command using the Windows Run dialog or, in some campaigns, a macOS terminal.

The command typically calls PowerShell or mshta.exe to download and execute a script from a remote server. That script retrieves the malware payload, such as a ZIP archive containing Lumma Stealer, and the malicious program then runs on the victim's machine.

Attackers can break the process into several stages and obscure the scripts involved. Obfuscation makes code harder to read, helping hide what it does. Some infection chains use image files with .png or .gif extensions containing hidden code, alongside additional payloads intended to evade detection.

Some campaigns have also used obfuscated JavaScript embedded in files that appear harmless, including MP3s and PDFs. These disguises add another layer between the familiar verification screen and the software eventually installed on the device.

After execution, the malware begins sending information to attacker controlled servers. It often uses encrypted HTTPS connections to evade network monitoring. HTTPS is the encrypted connection widely used for web traffic, so the transfer can be harder to inspect when it is mixed with ordinary online activity.

The consequences extend across industries and borders

Telecommunications companies face attacks aimed at customer and infrastructure data. Healthcare organisations encounter threats to medical portals and patient information. In finance and banking, stolen credentials can lead to unauthorised transactions. Hospitality businesses face lures built around Booking.com and similar services.

The international spread includes the United States, Europe and Asia. LAC's detections in multiple client environments and Gen Digital's reported increase in Japan show the problem reaching beyond a single website or isolated campaign. The reported financial and data losses affect both individuals and organisations.

Advanced persistent threat groups, often called APT groups, have also adopted ClickFix style attacks. These groups pursue sustained access to targets. State sponsored actors from North Korea, Iran and Russia have used the technique for espionage and persistent access to corporate networks.

For a person, the immediate risk is the theft of account details, financial information or private files. For an organisation, an infected employee computer can expose customer records, internal information or credentials used to access other systems. Remote access malware adds the prospect of continued attacker access.

ClickFix changes where the decisive action happens. The fraudulent website supplies instructions, but the user executes them locally. That reliance on human action, combined with increasingly sophisticated and modular malware, makes the attack difficult to detect and requires protection at several points in the process.

Recognising a fake CAPTCHA before running anything

A CAPTCHA that asks for a system command is the clearest red flag. Users should close a page that tells them to open the Run dialog, paste code into a terminal or execute a command. Requests to download software or install a browser extension also warrant suspicion.

Unexpected popups deserve attention, especially when they appear after an advertisement or a link in an unsolicited email. Website addresses can provide further warning: a misspelled domain or an address unrelated to the service being presented may reveal an impersonation attempt.

Individuals can reduce exposure by entering a service's address directly rather than following links in emails or advertisements. They should avoid running commands from untrusted sources, keep operating systems and other software updated, and use reputable security software with real time protection and current detection information.

Security patches help protect against software vulnerabilities, while recognising deceptive instructions addresses the human part of ClickFix. Learning the warning signs and sharing them with others adds another layer of protection. The useful rule is simple enough to remember: proving you are human does not require running code on your computer.

Organisations need controls as well as training

Organisations can restrict the ability of users without administrator privileges to run PowerShell or mshta.exe commands through Group Policy or endpoint management tools. These controls address the tools commonly used after a victim follows a fake CAPTCHA's instructions.

Endpoint Detection and Response systems, known as EDR, can monitor unusual command execution and network traffic. Web filtering and updated blocklists can stop access to known malicious domains and addresses. Together, these measures target both the website that delivers the instructions and the activity that follows on the computer.

Multifactor authentication, or MFA, adds another requirement beyond a password and can reduce the impact of credential theft. Regular security awareness training should teach employees to recognise phishing messages, fake challenges and other social engineering tactics, including requests disguised as routine verification.

Incident response plans should provide for rapid isolation and investigation of infected endpoints. Employees need a way to alert the security team when they have followed suspicious instructions so that the organisation can act before more information is taken.

Technical controls and user education address different parts of the same attack. Filtering may stop the malicious page, monitoring may identify a suspicious command, and a trained employee may refuse the request altogether. The combination is valuable because ClickFix depends on a sequence of actions rather than a single deceptive screen.

What to do after a suspected infection

Anyone who suspects they have executed a command from a fake CAPTCHA should disconnect the device from the network immediately to prevent further data being sent out. In a workplace, they should contact the IT or security team so the device can be isolated and investigated.

A full malware scan using reputable security software is another response step. Passwords for accounts accessed from the infected device should be changed, especially those for banking, email and cloud storage. Account activity should be monitored for suspicious changes or transactions, and additional protections such as MFA should be enabled.

The broader lesson from the attacks observed by June 23, 2025, is that a familiar security design can carry an unfamiliar and dangerous request. Criminals combine convincing pages, instructions initiated by users and malware capable of stealing a wide range of information. Recognising the command request, maintaining technical protections and responding quickly to a suspected infection address the concrete risks.

Key Points

• Fake CAPTCHAs use ClickFix instructions to persuade visitors to execute malware on their own devices.
• Legitimate CAPTCHAs never require users to open command tools, paste code or install software to complete verification.
• LAC detected incidents from late 2024 and reported a marked increase in 2025.
• Gen Digital reported growth of more than 600% in attacks using fake CAPTCHAs in Japan in 2024.
• Lumma Stealer can take passwords, cookies, cryptocurrency credentials, authentication data and sensitive files.
• Phishing emails, malicious advertisements, manipulated search results and compromised websites can deliver the fraudulent challenges.
• Protection combines command restrictions, monitoring, web filtering, software updates, MFA and user education.
• After suspected infection, disconnect the device, contact the security team, scan for malware, change passwords and monitor accounts.