Hackers Use Fake CAPTCHA To Infect Windows PCs

[harlan4096]

Hackers are using fake CAPTCHA verification pages to trick Windows users into running malicious PowerShell commands that install information-stealing software.

Security researchers at LevelBlue say that the campaign publishes StealC, an information stealer that exfiltrates browser credentials, cryptocurrency wallets, Steam accounts, Outlook login data, system information, and screenshots. The stolen data is sent to a command-and-control (C2) server using RC4-encrypted HTTP traffic.
Similar hacks we've already seen in the past.

How the attack works

Attackers inject JavaScript into these sites. When users visit, they are redirected to a fake CAPTCHA page designed to look like a Cloudflare verification screen.



Instead of presenting a traditional image or checkbox challenge, the fake CAPTCHA instructs users to:

1. Press Windows key + R
   
2. Press Ctrl + V
   
3. Press Enter
   

The instructions are framed as part of a verification process.

This technique, referred to as “ClickFix,” exploits user trust in simple keyboard prompts. Victims are made to believe they are completing a routine security check as usual.

Continue Reading...