CAPTCHA and ClickFix Abuse Fuels Credential Theft Surge

Microsoft threat intelligence observed a large, active surge in hosted credential-phishing campaigns in Q1 2026, highlighting rapid growth in QR-code phishing, CAPTCHA-gated pages, and ClickFix-style command-paste tricks that bypass traditional attachment scanning. The report documents ~8.3 billion email-based phishing threats for the quarter, spikes to ~11.9M CAPTCHA-gated attacks and ~18.7M QR-code attacks in March, the resilience of PhaaS platforms like Tycoon2FA, and recommends layered email and identity defenses including phishing-resistant MFA, conditional access, and targeted user training.