Fake CAPTCHA sites now have tutorial videos to help victims install malware

In 2025, a new cybercrime campaign called ClickFix emerged, utilizing fake CAPTCHA sites and clipboard hijacking to trick users into installing malware, specifically the Lumma Stealer and Atomic Stealer. Researchers noted that these campaigns have become more sophisticated, now including video tutorials to guide users through the installation process. The sites detect the user's operating system and provide tailored instructions, increasing the likelihood of infection.

To combat this threat, users are advised to slow down when following online instructions, avoid running commands from untrusted sources, limit copy-pasting commands, secure their devices with anti-malware solutions, and stay informed about evolving attack techniques.