For years, the message has been simple:
- Don’t click suspicious links.
- Don’t open strange attachments.
- Be careful with phishing emails.
Still good advice, but it’s no longer the full picture.
Because one of the most effective attacks we’re seeing now might not start in your inbox at all.
It looks like a normal website
You land on a page.
It might be:
- A document link
- A supplier portal
- A login page
- Even a legitimate website that’s been compromised
Then you see something familiar:
“I’m not a robot”
Click to verify.
Seems harmless.
What happens next is the problem
Instead of a normal CAPTCHA, you’re shown instructions.
Something like:
- Press Windows + R
- Paste this code
- Click OK
That’s it.
No download button.
No obvious malware.
No warning signs.
Just a simple action that feels routine.
Why this works so well
Because it flips the model.
Instead of delivering malware, the attacker gets you to run it yourself.
The latest threat intelligence shows fake CAPTCHA and “ClickFix” style attacks were among the most common techniques observed, accounting for a huge portion of incidents.
They work because:
- People trust CAPTCHA prompts
- The action feels like part of normal browsing
- Nothing looks obviously malicious
From a security point of view, it’s clever.
From a business point of view, it’s dangerous.
It bypasses what you think is protecting you
Most protections are designed to:
- Block malicious downloads
- Filter emails
- Detect known threats
This doesn’t rely on any of that.
The command is executed directly on the machine, often using built-in tools like PowerShell or mshta.
That means:
- No file to scan
- No obvious malware signature
- No clear trigger for traditional tools
It blends in.
What gets deployed after the click
Once that command runs, it usually doesn’t stop there.
We’re seeing:
- Remote access tools installed silently
- Password stealers running in the background
- Persistent access being set up
In many cases, legitimate tools are used so everything looks normal.
The report highlights that attackers frequently deploy tools that blend into everyday IT activity, making detection harder.
Why this matters for your business
This isn’t a “technical” attack – it’s behavioural.
It relies on:
- Habit
- Speed
- Trust
In a busy environment, especially on sites or under pressure, it’s easy to follow instructions without thinking twice.
This is bigger than phishing
Phishing is still a problem.
But this shows how things are evolving.
It’s no longer just:
“Don’t click the link”
It’s:
“Be careful what you’re asked to do after you click”
What actually helps reduce this risk
There isn’t a single fix.
But there are a few layers that make a big difference.
Security awareness that reflects real attacks
Traditional training focuses heavily on emails.
It now needs to include:
- Fake CAPTCHA scenarios
- Browser-based attacks
- Social engineering beyond inboxes
People don’t need fear. They need recognition.
Strong email and link protection
Even though this isn’t always email-led, many attacks still start there.
Advanced email security helps:
- Stop malicious links reaching users
- Scan links after delivery
- Detect compromised accounts
Browser and web protection
This is becoming more important.
Controls that:
- Block known malicious domains
- Prevent risky scripts from running
- Stop connections to suspicious infrastructure
…can break the chain early.
Monitoring what happens after the click
This is the part most businesses miss.
If something runs:
- unexpectedly
- from an unusual source
- in a way that doesn’t match normal behaviour
You need visibility – early detection and response is what stops these attacks before they escalate.
The real takeaway
The most dangerous click isn’t always in your inbox anymore.
It’s the one that asks you to do something that feels normal… but isn’t.
If you want to take a closer look
We help businesses across Chesterfield, Sheffield, and beyond put the right protections in place without overcomplicating things.
From email security to user awareness and real-time monitoring, it’s about making sure one click doesn’t turn into something bigger.
If you want to sense check where you stand, just get in touch.
For a more technical deep dive, please see the blog from our partners at Huntress: https://www.huntress.com/blog/clickfix-malware-buried-in-images
Credit to Huntress for the images.
Why fake CAPTCHA attacks are so effective
Looks familiar
Users trust CAPTCHA prompts and don’t question them.
No obvious malware
The attack runs through built-in tools, not downloaded files.
User-driven execution
The action is carried out by the user, not forced by software.
Harder to detect
Traditional tools often miss behaviour that looks normal.
Stopping the click is one thing. Catching what happens next is another.
The most effective protection comes from combining prevention and detection. These two solutions work together to stop threats before and after that click happens.
Email Security for Microsoft 365 (Avanan)
Stop phishing emails, malicious links, and account compromise attempts before they reach your inbox or trick your team into clicking.
See how email security works → Detection & ResponseHuntress Managed EDR
If something does get through, detect and stop suspicious activity on devices quickly with 24/7 monitoring and real human response.
Explore Huntress EDR →
