Fake CAPTCHA sites now have tutorial videos to help victims install malware

Attackers running the ClickFix campaign use fake CAPTCHA pages that detect the visitor OS, copy malicious commands to the clipboard, and pressure users (countdowns, tutorial videos) into pasting and executing those commands, resulting in installation of information-stealing malware such as Lumma and Atomic Stealer; the campaign spreads via SEO-poisoned search results, email, social media, and ads, and the report provides user-focused mitigation guidance (don’t run untrusted commands, use up-to-date anti-malware, avoid copy-pasting commands).