Hackers Are Using Fake CAPTCHAs to Install Malware and Disable Security Software

A CAPTCHA is something most of us see every day when visiting a website. It usually asks us to confirm that we are human.

But what if that CAPTCHA is fake?

Cybercriminals are now using fake CAPTCHA and verification pages to trick users into installing malware themselves.

Recent campaigns have combined fake Google reCAPTCHA and Cloudflare-style verification pages with a technique known as ClickFix. Instead of exploiting a software vulnerability, attackers convince the victim to copy and run a malicious command on their own computer.

The result can be much more serious than a simple malware infection. In some attacks, the malware can even attempt to disable antivirus and Endpoint Detection and Response (EDR) software before stealing information from the system.

How the Attack Starts

The attack often begins when a user visits a compromised website.

The website may look completely normal, but hidden malicious code has been added to it.

The user is then shown a fake verification page such as:

• Google reCAPTCHA

• Cloudflare Turnstile

• Windows Blue Screen of Death

• A fake browser security warning

The page tells the user that they need to complete a verification or troubleshooting step.

This is where the real attack begins.

The "ClickFix" Trick

The fake page instructs the user to perform a series of actions that appear to be part of the verification process.

For example, the user may be told to:

1. Open Windows PowerShell.

2. Paste a command that has been copied to the clipboard.

3. Press Enter to complete the verification.

The command is actually malicious.

Once the user executes it, the malware infection begins.

Why is this technique dangerous?

Because the user is unknowingly performing the attacker's job.

There may be no suspicious file download and no obvious exploit.

The victim simply follows the instructions shown on the screen.

This is why security awareness is becoming increasingly important alongside antivirus and EDR solutions.

What Happens After the Command Is Executed?

Once the malicious PowerShell command runs, the attack can move through several stages.

A simplified version looks like this:

Compromised Website
↓
Fake CAPTCHA
↓
User Runs PowerShell Command
↓
Malware Loader Is Downloaded
↓
Security Evasion
↓
Information-Stealing Malware
↓
Data Theft

Researchers observed these campaigns using a malware loader called Cruciferra.

Cruciferra has capabilities designed to make it harder for security software to detect and stop the attack.

Attackers Are Also Using Legitimate Windows Programs

One technique used in this campaign is called DLL side-loading.

This sounds complicated, but the basic idea is relatively simple.

Attackers place a malicious DLL next to a legitimate Windows executable.

The legitimate program then loads the malicious DLL.

From the outside, it may appear that a trusted Microsoft-signed application is running.

However, the application has been manipulated to load attacker-controlled code.

This can make detection more difficult because security teams cannot simply assume that a digitally signed Windows program is safe.

Malware Can Hide Inside Legitimate Processes

The attack can also use a technique called process hollowing.

In simple terms, attackers start a legitimate Windows process and then replace or inject its memory with malicious code.

The malicious program can then appear to be running under the name of a legitimate Windows process.

Researchers observed activity involving ServiceModelReg.exe.

This means security teams should look beyond the name of a process and examine its behavior, parent process, command line, loaded DLLs and network connections.

The Most Serious Part: Attempting to Disable EDR

The most concerning capability of this attack is its ability to interfere with security software.

Cruciferra can use a technique known as Bring Your Own Vulnerable Driver (BYOVD).

What is BYOVD?

BYOVD stands for Bring Your Own Vulnerable Driver.

Instead of creating a new malicious driver, attackers abuse a legitimate driver that contains a known security weakness.

Because the driver may be digitally signed, it can sometimes be trusted by Windows or security controls.

Once loaded, the vulnerable driver can provide the attacker with powerful system-level access.

In the reported campaign, the malware uses a vulnerable driver to attempt to terminate security-related processes.

Researchers reported that the malware can target processes belonging to products such as:

• Microsoft Defender

• Microsoft Defender for Endpoint

• CrowdStrike Falcon

• SentinelOne

• Sophos

• Bitdefender

• Cortex XDR

• Other antivirus and EDR products

If successful, this can leave the endpoint with significantly weaker protection.

Why This Matters to Businesses

This attack is not just about one piece of malware.

It shows how attackers are combining social engineering and technical attack techniques into a single infection chain.

The attacker does not necessarily need to find an advanced vulnerability in the victim's computer.

Instead, they can convince the victim to run the first command.

After that, automated malware can perform the remaining steps.

This makes the attack particularly dangerous for organizations where employees regularly browse the internet, download software or follow troubleshooting instructions from websites.

What Should Employees Look Out For?

The most important warning sign is simple:

A legitimate CAPTCHA should not require you to open PowerShell or Command Prompt and execute a command.

If a website tells you to:

• Press "Win + R"

• Open PowerShell

• Open Command Prompt

• Copy a command

• Paste something into a terminal

• Run a command to "verify that you are human"

• Run a command to "fix your browser"

• Disable antivirus or security software

Stop immediately.

Close the page and report it to your IT or security team.

What Should Security Teams Do?

Organizations can take several steps to reduce the risk of these attacks.

1. Monitor PowerShell

Security teams should monitor PowerShell activity, especially when it occurs shortly after a user visits a suspicious website.

Unexpected PowerShell execution should be investigated.

2. Protect Against Vulnerable Drivers

Organizations should enable available Microsoft vulnerable-driver protection mechanisms and keep endpoint security products updated.

This can help prevent attackers from abusing known vulnerable drivers.

3. Monitor New Driver and Service Creation

Security teams should investigate unexpected driver files and services, particularly when drivers are written to unusual locations such as: C:\Windows\Temp\

4. Monitor Suspicious DLL Loading

Security teams should look for legitimate Windows applications loading DLL files from unusual or user-writable directories.

A Microsoft-signed executable should not automatically be considered safe.

5. Monitor Security-Product Termination

Attempts to stop or terminate antivirus and EDR processes should generate security alerts.

This can be an important indicator that an attacker is attempting to disable endpoint protection.

6. Train Employees

Security awareness training is one of the most effective defenses against ClickFix-style attacks.

Employees should understand that websites should never be trusted simply because they look like Google, Microsoft or Cloudflare.

A professional-looking CAPTCHA can still be malicious.

A Simple Rule for Employees

Remember this:

CAPTCHA = Click

PowerShell = Stop

If a CAPTCHA asks you to open PowerShell and run a command, do not do it.

Contact your IT or security team instead.

What Makes This Attack Different?

Traditional malware attacks often try to exploit a vulnerability or automatically download a malicious file.

ClickFix attacks take a different approach.

They combine:

Social Engineering
→ Trick the user

PowerShell
→ Execute the command

DLL Side-Loading
→ Hide malicious code behind a legitimate application

Process Hollowing
→ Hide malware inside a legitimate process

BYOVD
→ Abuse a vulnerable driver

EDR Tampering
→ Attempt to weaken security controls

Information Stealing
→ Collect sensitive information

This combination makes the attack chain particularly dangerous.

How GTIS Can Help

Modern attacks are no longer limited to viruses and traditional malware.

Organizations need to identify weaknesses across endpoints, applications, networks, cloud environments and security controls.

GTIS helps organizations strengthen their cybersecurity posture through services including:

• Vulnerability Assessment & Penetration Testing (VAPT)

• Web Application Security Testing

• Network Security Assessment

• SOC Monitoring

• SIEM

• Managed Detection and Response (MDR)

• PCI DSS Compliance

• ISO 27001 Consulting

• Security Audits and Assessments

Our security assessments can help organizations identify weaknesses that attackers could potentially exploit before they become serious incidents.

Final Takeaway

Fake CAPTCHA attacks are a reminder that cybersecurity is not only about protecting systems from technical vulnerabilities—it is also about protecting people from manipulation.

A webpage can look completely legitimate and still be controlled by an attacker.

If a CAPTCHA or verification page asks you to open PowerShell, paste a command or execute something on your computer, do not continue.

For organizations, the best defense is a combination of employee awareness, strong endpoint protection, PowerShell monitoring, vulnerable-driver protection, security monitoring and regular security assessments.

Think before you click. Verify before you execute. Stay secure with GTIS.