Fake CAPTCHA Attacks: $370M in January, $158B in 2025

The scale of these attacks is staggering, with cybersecurity firms protecting over 1.4 million customers in just four weeks from fake CAPTCHA campaigns. This isn't a niche threat but a persistent, high-volume vector used to distribute dangerous malware. The primary payload is Lumma Stealer, a tool specifically engineered to steal sensitive data like login credentials and cryptocurrency wallets, making it a prime weapon for financial theft.

The attack mechanism is a sophisticated form of social engineering known as "ClickFix." It begins with a phishing email, often impersonating a trusted entity like GitHub. When a user clicks the malicious link, they are directed to a fake CAPTCHA screen that mimics a legitimate verification process. The critical deception occurs when the user clicks the "Verify" button. Instead of completing a security check, this action copies a malicious PowerShell command to the user's clipboard and provides step-by-step instructions to execute it.

The instructions are deceptively simple: users are told to press the Windows key + R, paste the command, and press Enter. This action triggers the script to contact a command-and-control server, downloading and installing the Lumma Stealer. To evade detection, attackers are now using signed Microsoft components like SyncAppvPublishingServer.vbs to proxy the execution of malicious code through trusted system binaries, a technique known as "living off the land." This combination of scale, deceptive mechanics, and stealth makes fake CAPTCHA attacks a highly effective and scalable theft vector.

The Stolen Value: A Record-Breaking Year and a High-Profile Monthly Peak

The illicit crypto ecosystem is capturing staggering flows, with annual theft hitting a new record. In 2025, the total value stolen reached $158 billion, a nearly 145% year-over-year surge. This explosive growth underscores how deeply financial crime has woven into the crypto fabric, even as illicit activity's share of total on-chain volume dipped slightly.

A single state actor drove a significant portion of this theft. North Korean hackers stole $2.02 billion in 2025, marking a 51% increase from the prior year. Their all-time total now stands at $6.75 billion, demonstrating a shift toward fewer but larger, more sophisticated attacks that target critical infrastructure and high-value assets.

The trend continued into early 2026 with a sharp monthly spike. In January, stolen value surged to $370.3 million, the highest monthly total in 11 months. This figure represents a nearly fourfold jump from January 2025's $98 million, driven overwhelmingly by phishing and social engineering scams. The data shows that while annual theft sets new benchmarks, individual months can see extreme volatility, with a single $284 million scam skewing the January total.

Attack Evolution and Flow Metrics to Watch

The attack methodology is rapidly evolving to bypass defenses. The latest campaigns are now using signed Microsoft Application Virtualization (App-V) scripts, like SyncAppvPublishingServer.vbs, to proxy malicious execution. This "living off the land" technique allows attackers to run PowerShell commands through trusted system binaries, making detection far more difficult. This shift from direct PowerShell invocation to abusing legitimate Microsoft components represents a significant escalation in sophistication.

Social engineering remains the dominant theft vector, with a single incident driving most of the recent surge. In January, a $284 million scam accounted for the bulk of the $370.3 million in total losses. This pattern of extreme concentration-where one large attack skews monthly figures-highlights the vulnerability of human targets and the massive value at stake in a single successful phishing campaign.

For forward-looking monitoring, two metrics are critical. First, track the volume of malware distribution via fake CAPTCHA campaigns, as seen in the protection of over 1.4 million customers in recent weeks. Second, watch wallet compromise rates, which surged to 158,000 incidents in 2025. A spike in either indicator would signal an imminent wave of theft, as these flows directly precede the large-scale data and asset exfiltration that fuels the $158 billion annual crime economy.