We’ve all seen them.
"Click here to verify you’re human."
Seems harmless, right?
Except now, attackers are using fake CAPTCHAs to trick people into downloading malware, stealing credentials, and running malicious scripts on their systems.
That’s exactly what’s happening in the latest Lumma Stealer campaign, where phishing PDFs embedded with fraudulent CAPTCHA images are redirecting users to malicious sites and in some cases, getting them to execute PowerShell commands that install malware.
And the worst part? These PDFs are being hosted on legitimate platforms like Webflow, GoDaddy, and even online document repositories. Meaning, if you’re searching for certain files, you could land on one of these poisoned links without even realizing it.
This isn’t your typical “urgent email from IT” phishing attack. It’s smarter. It’s subtle. And it’s catching people off guard.
Why Fake CAPTCHAs Work
Because CAPTCHAs are supposed to be a security measure, not a security risk. Most people see a CAPTCHA and assume they’re in a safe environment.
Attackers know this. So they exploit it.
Instead of tricking you into filling out a form, they convince you to click something you normally wouldn’t, like:
A fake “download” button that actually runs a script.
A redirect that sends you to a malicious website.
A PowerShell execution command that loads malware onto your device.
How to Spot a Fake CAPTCHA
Not every CAPTCHA is legit. Here’s how to tell when something’s off:
1️⃣ You weren’t expecting a CAPTCHA in the first place.
2️⃣ It asks you to download something.
3️⃣ It’s hosted on a sketchy or unexpected website.
4️⃣ It doesn’t actually test anything.
5️⃣ It asks for personal information.
What You Can Do About It
If you’re in security, you should be educating employees right now because this attack is convincing enough to trick smart people.
Lock down PowerShell execution policies. If a user clicks the wrong thing, don’t let it run a script without admin approval.
Train employees on phishing beyond email. Malicious PDFs, SEO poisoning, and AI scams are the next evolution of phishing.
Use security tools that detect fake redirects and malicious scripts. If you’re relying on basic AV and email filtering, you’re already behind.
Attackers know that people trust CAPTCHAs. They’re now using that trust against them.
A real CAPTCHA protects you.
A fake CAPTCHA infects you.