I’m Not a Robot: How a Fake CAPTCHA Let Rhysida Into Berlin

Sometime in the summer of 2026, an employee of Berlin’s Senate Department for Mobility, Transport, Climate Protection and the Environment opened what turned out to be a phishing email. It led to a web page. The page asked for something most of us do several times a week without thinking about it, confirm that you are not a robot.

Nobody outside the investigation knows exactly what that employee saw on screen. But Germany’s Federal Office for Information Security (BSI) and Microsoft have both described this kind of fake CAPTCHA attack in detail. A familiar checkbox. Then a short instruction that looks like part of the same check: press a key combination, paste the text that has already been copied for you and press Enter. It takes about three seconds. No password is typed into a fake login page.

It was enough. Over the following days the ransomware group Rhysida copied what it claims were 5.79 terabytes out of two Berlin Senate departments. When the city refused to pay 30 bitcoin, about two million euros, the group published roughly 1.4 million files on the dark web. Personnel files, scanned ID cards, birth certificates of employees’ children and plaintext password lists were among them, according to Tagesspiegel.

The page had asked the employee to prove they were human. That is exactly what they did, the way any of us would. The click itself was tiny. Almost everything that turned it into a disaster was already in place long before it.

The Berlin Attack in Brief

• What happened: the Rhysida group stole data from two Berlin Senate departments (urban development and transport), mainly between 7 and 12 August 2026. The group claims to hold 5.79 TB.
• How they got in: a fake CAPTCHA attack. A phishing email led an employee to a fake CAPTCHA that told them to paste a command into Windows Terminal or PowerShell, according to German media reports. The BSI has publicly linked the incident to the TerminalFix campaign. Berlin has not published the full attack chain.
• What was leaked: about 1.4 million files, published after Berlin refused a 30 bitcoin ransom, including personnel files, ID scans and plaintext passwords.
• Why it got so big: the stolen material came mostly from shared and personal network drives across two departments. Data left the network for days unnoticed.
• The lesson: train people to spot fake CAPTCHAs. Then design the network so one click cannot cost you everything.

Seven Days Nobody Noticed

Berlin’s forensic findings put the main data outflow between 7 and 12 August 2026, from the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment. The intrusion itself started earlier. On 14 August both departments were cut off from the Landesnetz, the state network that connects Senate departments, subordinate authorities and the districts. The public found out three days later, heise reported.

The disconnection was felt immediately. Staff in the two departments had no email or internet and could be reached only by phone and fax. By 21 August housing benefit payments to more than 50,000 eligible Berlin households were stuck, according to heise’s timeline. Both departments were reconnected on 23 August.

Then came the extortion. Rhysida listed Berlin on its leak site, demanded 30 bitcoin and advertised samples including plaintext password lists and more than 46,500 state contracts. Florian Hauer, Berlin’s Chief Digital Officer, gave the city’s answer, “The State of Berlin will not give in to blackmail,” he said. Passwords for specialist applications had already surfaced. At the start of September the two departments shut off home-office access to their networks for the second time. One of the exposed passwords was “Sonnenschein13” (“Sunshine13”), Tagesspiegel reported.

The ultimatum ran out on 4 September, just over two weeks before the 20 September election to the Berlin House of Representatives. Rhysida published the files. A second package containing login credentials followed on 6 September.

On 16 October the Senate Chancellery said the immediate threat was over and that there had been no further attacks on the affected parts of the network since 13 August. The leaked data is still being analysed, according to Berlin.de.

The People Inside 1.4 Million Files

Behind the terabytes are names. DW counted 1,439,893 files and listed pay slips, official correspondence, phone numbers and home addresses among them. Tagesspiegel confirmed that the dump also holds rehabilitation records, certificates of good conduct and internal emails. Rhysida itself claimed 148 IBANs in the data.

Most of the people in those files never clicked anything. Think of an engineer whose child’s birth certificate was scanned into a personnel folder years ago. Or a resident whose administrative case ended up on a shared drive. The Senate has said it will contact affected citizens, employees and companies by letter or email, prioritised by risk. Until that letter arrives, they cannot know whether they are in the archive.

Then there is the one person who did click. Thorsten Schleheider, deputy Berlin chair of the police union GdP, was blunt after the leak: “Our colleagues are not to blame that IT security in the State of Berlin has been run into the wall for decades,” he said, as quoted by Berliner Zeitung. Security researchers at G DATA reached the same conclusion from the technical side. The attack needed many steps and a lot of time so holding the employee solely responsible would be wrong.

What Is a Fake CAPTCHA Attack (ClickFix)?

A fake CAPTCHA attack, often called ClickFix, is a social engineering technique in which a web page imitates a “verify you are human” check and then instructs the visitor to copy and run a command on their own computer. The command installs malware. A real CAPTCHA never asks you to leave the browser, open a system window or paste anything.

The technique appeared in 2024 and spread faster than almost any initial access method before it. ESET measured a 517 percent increase between the second half of 2024 and the first half of 2025. Microsoft’s Digital Defense Report 2025 found ClickFix was the most common way in for incidents handled by its Defender Experts team, at 47 percent, ahead of classic phishing at 35 percent. MITRE added it to the ATT&CK framework in April 2025, in version 17, as technique T1204.004. The trend has not slowed: ESET’s H1 2026 Threat Report recorded a 108 percent year-on-year rise in ClickFix detections, CybelAngel notes, making it the second most common attack vector after phishing.

	Real CAPTCHA	Fake CAPTCHA (ClickFix)
Where it happens	Inside the browser	Pushes you out to the Run box, Terminal or PowerShell
What it asks	Tick a box, pick images, type characters	Press Windows+R or Ctrl+V, paste, press Enter
Clipboard	Never touched	Silently filled with a malicious command
Result	You reach the page	Malware runs with your permissions

The reason is simple. Email filters hunt for malicious attachments and known bad links. Endpoint tools watch for suspicious files arriving on disk. ClickFix brings neither. The victim types or pastes the first stage themselves, so it runs as the user, with the user’s permissions, through tools Windows trusts.

How TerminalFix Turned One Computer Into a Tunnel

TerminalFix is the fake CAPTCHA attack variant that reached Berlin. Microsoft described the campaign on 28 August 2026. On 4 September the BSI issued a security advisory, rated criticality 2 (high), after a German state institution was compromised in the same pattern. The advisory does not name Berlin. The BSI confirmed on Mastodon that it was involved in the Berlin investigation and linked to it. Tagesspiegel reported that the entry point was a phishing email to an employee of the transport administration. Berlin itself has not confirmed the full attack chain.

The chain Microsoft documents runs like this. A legitimate website is compromised and shows a fake Cloudflare verification overlay. The instructions tell the visitor to paste a command into Windows Terminal or PowerShell, rather than the Run dialog used by older ClickFix lures. A terminal accepts longer scripts. The command pulls in further stages: a malicious DLL loaded by a legitimate program, payloads hidden inside PNG images and persistence so the foothold survives a reboot. Next comes reconnaissance of Active Directory, including domain trusts, domain admin accounts and user description fields where administrators sometimes leave passwords. Finally a Python-based reverse tunnel starts with no visible window and connects out over an encrypted WebSocket on port 443.

That last step changes the scale of the damage. Earlier ClickFix campaigns mostly dropped infostealers that scraped browser passwords from a single machine. A reverse tunnel turns the employee’s computer into a doorway. The attacker can reach any server, file share or system that the computer can reach. The traffic looks like ordinary HTTPS.

The BSI found the fake CAPTCHA’s JavaScript on several hundred websites, including ordinary sites that had been quietly tampered with. It describes the attackers as financially motivated and opportunistic. They take whoever falls into the trap, not only public authorities. G DATA adds that the data finally left Berlin through cloud storage using the cloud provider’s own copy tools.

Why Careful People Still Paste the Command

It is tempting to file Berlin under failed training. It is more useful to ask why the trick works on people who have been trained.

Twenty years of CAPTCHAs have taught us that clicking a box to prove we are human is a normal toll on the way to something we need. The fake version borrows that trust and adds one more step that feels like part of the same routine. The clipboard is pre-filled. The shortcut takes a second. Classic phishing training tells people to check the sender, hover over links and never type a password into an unknown page. A fake CAPTCHA asks for none of those things. It asks the user to do something nobody warned them about.

Context does the rest. The page sits on a real website. Nothing on screen looks like an attack, because the attack is the user’s own keystrokes.

Awareness still matters. One rule covers nearly every variant, if a “verification” asks you to press Windows+R, open a terminal or paste anything, it is not a CAPTCHA. Close the tab and report it. That rule belongs in every security awareness programme and phishing simulation this year. But an organisation that relies on every employee recognising every new lure, every day, has made one person its last line of defence by design. Microsoft’s own guidance pairs the warning with technical controls on who can run PowerShell and terminals at all.

One Workstation, Two Departments

The second lesson is the one Berlin’s critics have focused on. Compromising one computer should not mean compromising two government departments.

Berlin has not published what permissions the employee’s account held. Guessing would be unfair. What is public is enough to see the problem. According to the state’s own description, summarised by SOCRadar, most of the stolen material was unstructured data from shared and personal employee directories rather than from specific business applications. Passwords sat in plain text in documents the attackers could read. heise concluded that this probably gave Rhysida “a relatively easy game”. Berlin’s Interior Committee had criticised the state’s cybersecurity for years, HiSolutions notes.

Detection did not close the gap either. Berlin has run a security operations centre at its IT service provider ITDZ since 2022, which recorded around 10 million unauthorised access attempts on the state network in a single year, according to dpa. Large volumes of data still left two departments over several days before anyone pulled the plug.

Put plainly, the click gave Rhysida one computer. The shared folders within reach, the credentials lying in plain text and the outbound traffic nobody questioned gave Rhysida the rest.

This is where most organisations should look first, because it is where they have the most control. What could one compromised laptop in your finance team reach this morning? Which shares, which servers, which folders called “IT” or “Passwords” that nobody has opened since 2021? An assumed-breach penetration test that starts from an ordinary user’s machine answers that faster than any policy review.

Rhysida Has Done This Before

Rhysida has operated as a ransomware-as-a-service group since mid-2023. In October 2023 it hit the British Library which refused to pay. Around 600 GB was published and some services were disrupted for months. Insomniac Games is another past victim. Bianca Kastl of the Chaos Computer Club pointed out to rbb that the group had already attacked the city of Stuttgart. A 2023 joint advisory from CISA, the FBI and MS-ISAC listed its usual ways in as VPN accounts without MFA, the Zerologon vulnerability and phishing. Berlin shows the group swapping its front door for whatever works best this year.

What to Check in Your Own Organisation This Week

None of this needs a new budget cycle. For organisations in Sweden it also feeds directly into the risk-management and incident-reporting duties under NIS2 and the Swedish cybersäkerhetslagen, as well as the GDPR breach notification clock.

• Teach the one rule that stops almost every fake CAPTCHA attack. Any CAPTCHA that asks for a key combination, a terminal or a paste is fake. Put a fake CAPTCHA lure into your next phishing simulation.
• Restrict the Run dialog, PowerShell and Windows Terminal for staff who have no business need for them. Turn on PowerShell script block logging for everyone else.
• Alert on a browser launching a terminal, pythonw.exe running from user folders and new long-lived outbound WebSocket connections from workstations. This is the pattern a 24/7 MDR and SOC service should be hunting.
• Map what a standard user account can reach and test it from a normal laptop. Shrink shared drives to the people who actually use them.
• Search file shares for plaintext credentials, move secrets into a password manager and rotate anything you find.
• Set thresholds for outbound volume to cloud storage. Seven days of exfiltration should trip an alarm long before day seven.
• Check whether your own organisation’s credentials already circulate in leaked data. A domain breach scan takes seconds.

If someone has already run such a command, the BSI’s advice is to close the browser immediately, reinstall the affected system and change every password used on it. Disconnect the machine from the network first.

Quick Answers on Fake CAPTCHAs

Back to the Desk

Somewhere in Berlin is an employee who followed what looked like a routine instruction on a page that looked like the rest of the internet. Thousands of colleagues and residents are waiting to learn whether their documents sit in a dark-web archive. The city spent the weeks before an election explaining why it would not pay.

The click took seconds. What made it so costly took years: shared folders nobody pruned, passwords saved in documents and days of outbound traffic that nobody questioned. No employee can fix those at their desk. They are decisions an organisation makes or postpones long before a web page asks anyone to prove they are human. Our review of five Swedish incidents from this year shows the same pattern closer to home.

References

1. TerminalFix campaign deploys a reverse tunnel through multistage intrusion
2. BSI statement on TerminalFix and the Berlin incident
3. Following a cyberattack: Immediate threat to the administration cleared
4. Nach Hackerangriff: Akute Gefährdung für Berlins Verwaltung gebannt
5. Cyberattacke auf Berlin könnte größere Folgen haben als bisher gedacht
6. Mit dieser Methode drangen die Hacker offenbar in Berlins IT-Netz ein
7. Der Daten-Leak war ein Anschlag, die Reaktion des Senats ein Skandal
8. Cyberangriff auf das Berliner Landesnetz

This post is also available in: