The Fake Captcha ecosystem often appears to be a single, coordinated campaign. Thousands of near-identical “verify you are human” pages are scattered across the web, many closely resembling legitimate Cloudflare-style browser checks. At first glance, this visual uniformity suggests shared tooling, centralized ownership, or a single threat actor operating at scale.

That assumption does not hold up.

What looks monolithic is, in reality, a fragmented and rapidly evolving abuse pattern. Fake Captcha has matured into a standardized interaction layer—one that separates the abuse of user trust from the malware delivery mechanisms that follow. The interface remains familiar and consistent. Everything behind it changes.

Rather than representing a campaign, Fake Captcha now functions as a reusable trust surface operating across unrelated infrastructure, delivery models, and control planes.

From Social Engineering to Ecosystem

Fake Captcha and “ClickFix” lures have been a persistent feature of web-based malware delivery for years. These pages imitate legitimate browser verification challenges and instruct users to complete tasks framed as security validation, access checks, or remediation. Early analysis correctly categorized them as social engineering, typically ending in clipboard-based execution where users unknowingly infect themselves.

Later research showed that Fake Captcha pages are often embedded within broader injection and redirection frameworks, functioning as a late-stage conversion step rather than an initial access vector.

As the technique scaled, an important question emerged: when thousands of pages look nearly identical, does that imply coordinated control—or simply the reuse of a successful interface?

To answer that, researchers examined Fake Captcha not as a single campaign, but as a web-native ecosystem.

Internet-Scale Visibility

This analysis draws on an internet-wide view of Fake Captcha activity derived from continuous observation of exposed web infrastructure through Censys.

At the time of analysis, 9,494 distinct assets exhibiting Fake Captcha behavior were actively tracked. These included both standalone malicious properties and legitimate websites compromised to inject Fake Captcha content. Rather than treating Fake Captcha as a single operation, it was tracked as a persistent and evolving threat category.

All assets were enriched using the Censys Platform API to retrieve full HTML bodies, embedded JavaScript, and client-side execution logic. Static metadata alone proved insufficient, as many implementations rely on dynamically generated scripts or late-stage logic that only appears when a page is rendered.

To capture what users actually see, each asset was rendered using a Playwright-based headless browser configured to mimic a standard Windows desktop environment. Screenshots captured after rendering became the foundation for visual analysis.

Visual Clustering and Its Limits

Screenshots were analyzed using perceptual hashing (pHash), which groups visually similar images even when they differ slightly due to compression, resizing, or branding. Using Hamming distance comparisons, researchers clustered pages by appearance rather than by underlying code.

This approach revealed a striking result. One visual cluster—referred to as Cluster 0—accounted for approximately 70% of all observed Fake Captcha pages. Its design closely mirrored a generic Cloudflare-style browser check, often embedding site-specific favicons to reinforce legitimacy.

At face value, Cluster 0 looks like a single campaign. It is not.

Fragmentation Beneath the Surface

Execution behavior could be extracted from 85.6% of Cluster 0 assets. Within that subset, researchers identified 32 distinct payload variants spread across fundamentally incompatible delivery models.

Some pages relied on clipboard-driven execution, including VBScript loaders, PowerShell downloaders, and lightly obfuscated command chains. Others bypassed scripting engines entirely, delivering payloads through Windows Installer packages using msiexec. A substantial subset exposed no client-side payload at all.

Instead, those pages handed off control to a server-driven framework commonly referred to as Matrix Push C2, publicly documented by BlackFog. In this model, Fake Captcha is not a payload prompt but a conversion step. Users are guided into granting browser notification permissions—most often in Chrome—after which operators can push malicious content later through the browser itself.

There is no clipboard command, no immediate download, and no static artifact at interaction time. Initial access is fileless and delivery is deferred.

From a visual perspective, these pages are indistinguishable from traditional ClickFix lures. Operationally, they diverge immediately.

Trust as the Real Artifact

Infrastructure analysis reinforces the point. Delivery infrastructure clusters by execution technique, not by interface. VBScript loaders, PowerShell delivery, MSI payload hosting, and Matrix Push C2 each rely on largely separate infrastructure pools with minimal overlap.

What remains consistent is not the payload or the backend—it is the interface.

Fake Captcha demonstrates a broader shift toward what defenders increasingly describe as “Living Off the Web”: systematic abuse of legitimate interfaces, security conventions, and platform-sanctioned workflows. Attackers no longer need to compromise trusted services. They inherit trust by operating inside interactions users are trained to accept.

In this environment, visual similarity is cheap and misleading. Trust—not malware—is the primary delivery mechanism.

Fake Captcha is no longer an edge case. It is a preview of where web-based abuse is heading next.