Barracuda: Fake CAPTCHAs Drive Malware and Phishing in 43% of 2025 Kits
Attackers use fake verification steps to bypass security tools, steal credentials, and trick users into running malware commands on their own devices.
Key points
- Barracuda found CAPTCHA abuse in 43% of phishing-kit attacks examined in 2025.
- Fake checks trigger malware downloads, credential theft, and malicious browser notifications.
- Attackers use clipboard-based commands to force victims to execute code manually.
Barracuda reports that attackers are increasingly using fake CAPTCHA challenges to deliver malware and steal credentials, finding this tactic in 43% of phishing kits analyzed during 2025. The security vendor explains that these verification steps now serve as gateways for malicious downloads and commands that victims are tricked into executing themselves.
These deceptive checks help attackers gain user trust, filter out automated security scanners, and conceal malicious content from inspection tools. By presenting a familiar "prove you are human" step, criminals make the subsequent malicious actions appear legitimate or necessary for accessing requested documents, invoices, or contracts.
How the Attack Works
An attack often begins with an email prompting the recipient to review a file. Clicking the link opens a page that demands CAPTCHA verification before allowing access. Completing this check may redirect users to a counterfeit Microsoft 365 login page designed to harvest credentials, or it may trigger immediate malware downloads and requests to enable browser notifications.
Some variants employ ClickFix techniques, where clicking a checkbox or verify button silently copies a malicious command to the user's clipboard. The page then instructs the victim to open the Windows Run dialog or another system tool, paste the text, and press Enter. This manual execution starts the malware infection without the user realizing they are running code.
Evasion and Adaptation
Barracuda Threat Analysis Associate Poojitha B notes that these pages can adapt based on a visitor’s device, location, activity, or timing. Some pages appear only briefly or expire after being viewed, which complicates post-incident investigation by security teams. This dynamic behavior allows attackers to evade detection while maintaining the illusion of a legitimate service interruption or verification requirement.
The use of AI and no-code development tools enables attackers to create highly customized CAPTCHA pages, login screens, and phishing sequences. These pages can incorporate the recipient’s specific details or their organization’s branding, with language and content adapted to the target to increase credibility and the likelihood of successful exploitation.
What should you do?
Security teams should monitor for unusual user behavior, such as mass requests to enable browser notifications or reports of confusing verification steps that require manual command execution. Users should be trained to recognize that legitimate services do not require pasting clipboard contents into system dialogs to verify identity.
What to do and how to stay safe: Barracuda
- Verify the URL and domain of any page requesting CAPTCHA verification before interacting with it.
- Never paste clipboard contents into system tools like the Windows Run dialog based on web instructions.
- Disable unnecessary browser notification permissions to prevent malicious alert campaigns.
- Report suspicious verification requests to your security team for immediate analysis and blocking.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How common is CAPTCHA abuse in phishing attacks?
Barracuda found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025.
What happens when a user completes a fake CAPTCHA?
Completing the check may lead to counterfeit login pages, malware downloads, or instructions to run malicious commands.
How do attackers evade security tools with these pages?
Fake CAPTCHAs prevent automated scanners from reaching the next page, and some pages expire quickly or adapt to visitor details.
