New Phishing Tactics Abuse CAPTCHA and ClickFix to Steal Credentials

Key Takeaways

• Cybercriminals are increasingly employing sophisticated phishing tactics, including fake CAPTCHA pages and ClickFix techniques, to steal credentials.
• These advanced methods bypass traditional email security, with CAPTCHA-gated phishing attacks more than doubling in March 2026, reaching 11.9 million.
• Threat actors rapidly rotate attachment types (SVG, PDF, HTML) to evade detection, with PDF attachments seeing a 356% increase in March 2026.
• Phishing-as-a-Service (PhaaS) platforms like Tycoon2FA, Kratos, and EvilTokens are facilitating these large-scale campaigns.
• Organizations must implement robust defenses, including user training, advanced email and endpoint protection, and phishing-resistant multi-factor authentication.

Cybercriminals are abandoning simplistic email phishing in favor of increasingly elaborate schemes that leverage fake CAPTCHA pages and ClickFix techniques. This strategic shift has dramatically escalated credential theft operations, as revealed in recent analyses of first-quarter 2026 threat intelligence.

During the initial three months of 2026, Microsoft Threat Intelligence recorded approximately 8.3 billion email-based phishing threats. Throughout this period, the primary objective of these campaigns consistently remained credential theft.

A particularly concerning trend was the significant surge in CAPTCHA-gated phishing, which saw a more than twofold increase in March alone, culminating in 11.9 million attacks. This represents the highest volume observed in over a year.

As organizations enhance their defenses against conventional phishing, attackers are adopting multi-layered social engineering strategies. These involve integrating deceptive security checks with seemingly legitimate web pages, designed to mislead both human users and automated security systems. For further details, refer to the Microsoft Threat Intelligence report.

Evolving Delivery Mechanisms

The rapid evolution of delivery formats underscores the adaptability of threat actors. Within mere weeks, attackers cycled through various attachment types, including HTML files, SVG attachments, PDFs, and Word documents. This continuous experimentation aims to identify the most effective methods for bypassing email filters.

By the end of Q1 2026, PDF attachments had emerged as the predominant vector for CAPTCHA-gated phishing content. This format experienced an astonishing 356% growth in March, following several months of decline. This swift rotation of file types indicates that attackers are conducting near real-time efficacy tests against existing email security infrastructures, as documented in a security report.

Microsoft analysts have meticulously tracked several campaigns, observing how threat actors ingeniously combine fake CAPTCHA challenges with ClickFix-style manipulation to circumvent conventional security controls. In a ClickFix attack, a deceptive CAPTCHA prompt persuades users to copy and execute a malicious command on their own system, under the mistaken belief that they are completing a legitimate human verification step. This tactic bypasses the need for traditional malware downloads, as victims unwittingly run the attacker’s code themselves.

The Phishing-as-a-Service (PhaaS) platform known as Tycoon2FA, identified by Microsoft as Storm-1747, played a significant role in this threat landscape during Q1 2026. However, its dominance in hosting CAPTCHA-gated phishing sites diminished over the quarter. While Tycoon2FA was responsible for over three-quarters of all such sites at the close of 2025, its share dropped to 41% by March 2026. This decline suggests a broader adoption of these techniques by other threat actors and phishing kits.

How the Attack Chain Unfolds

A notable example from Q1 2026 was a substantial three-day campaign from February 23 to February 25, 2026. This operation delivered over 1.2 million phishing messages to users across more than 53,000 organizations in 23 countries.

Attackers dispatched emails containing SVG file attachments, with filenames carefully chosen to align with the email’s theme, such as fabricated invoice notifications, payment alerts, 401K update reminders, and voice message notifications. Upon opening the SVG file, the recipient’s browser silently loaded content from attacker-controlled domains, displaying a deceptive “security check” CAPTCHA screen. After the user completed this fake verification, they were redirected to a spoofed sign-in page designed to capture their account credentials.

Another large-scale campaign on March 17, 2026, further illustrated the scope of these operations. This attack involved over 1.5 million malicious HTML messages sent to more than 179,000 organizations in 43 countries. Each email contained an HTML attachment that, when opened locally, redirected victims through a staging page before ultimately leading to a CAPTCHA-gated phishing site. The final phishing pages were hosted across various PhaaS providers, including Tycoon2FA, Kratos, and EvilTokens.

What You Should Do

• User Training and Awareness: Implement regular phishing simulations and comprehensive awareness programs to educate users on recognizing fake CAPTCHA challenges and suspicious email attachments.
• Advanced Email Protection: Enable Safe Links and Safe Attachments within Microsoft Defender for Office 365. Activate Zero-hour auto purge (ZAP) to automatically quarantine malicious messages retroactively.
• Endpoint Security: Ensure network protection is enabled in Microsoft Defender for Endpoint to mitigate threats at the device level.
• Strong Authentication: Deploy passwordless authentication methods, such as FIDO keys or Microsoft Authenticator, wherever feasible. Enforce phishing-resistant multifactor authentication (MFA) for all privileged accounts through conditional access policies.
• Automated Attack Disruption: Enable automatic attack disruption in Microsoft Defender XDR to contain ongoing attacks and provide security teams with critical time for response and remediation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.