And the source code of Really Simple CAPTCHA which is published is this. 4 characters are displayed in random font, and the two letters "O" and "I" are not used to avoid user confusion.

ClickFix uses fake CAPTCHA screens to trick users into launching malware via simple keyboard commands The phishing page mimics Cloudflare perfectly, right down to Ray IDs and security padlocks ...