Fake CAPTCHA/ClickFix Social Engineering Used to Deliver Malware and Steal Sessions

Threat actors are increasingly using fake CAPTCHA / verification pages as a scalable social-engineering lure to deliver malware and steal credentials by abusing users’ trust in routine web security checks. Research highlighted a large, fragmented ecosystem of lookalike fake CAPTCHA pages hosted across ~9,494 compromised sites and malicious properties, where roughly 70% of observed pages share near-identical visuals while delivering dozens of distinct payload variants via different execution models, including clipboard-driven instructions that lead victims to run PowerShell or VBScript downloaders.

Separately, a ClickFix campaign targeting Facebook users—especially content creators and businesses seeking verification—uses fake “verification” portals to trick victims into manually extracting and submitting browser session tokens (notably c_user and xs) via developer tools, enabling account takeover without exploiting software vulnerabilities. In parallel, the ClearFake campaign (a malicious JavaScript framework injected into hacked websites) has adopted ClickFix-style fake CAPTCHA lures and added more evasive “living off the land” behavior, including proxy execution to run PowerShell through trusted Windows features and shifting distribution to a popular CDN, reducing the effectiveness of defenses that rely primarily on blocking known-bad domains/IPs.