>> (p.1)
    Author Topic: New tactic for spreading malwares: Fake CAPTCHA verification  (Read 106 times)
    Forsyth Jones (OP)
    Legendary
    *
    Offline Offline

    Activity: 1610
    Merit: 1548


    I love Bitcoin!


    View Profile WWW
    April 20, 2025, 09:06:09 PM
    Merited by vapourminer (1)
     #1

    Be careful with fake CAPTCHA verifications. Hackers are using this new method to install malware like clipboard hijacking or other malicious software to steal personal data and mainly BTC/Crypto from users.

    The attack consists of the victim visiting a malicious site or one hijacked by malicious agents. They are asked to complete a normal CAPTCHA verification (like any site that uses CAPTCHA). However, after this, the victim is tricked into executing a command in Windows' Run, claiming it's a final verification step. The command is then copied to the clipboard without the victim noticing. In reality, it's a wget command to download malware onto victims' computers.



    Recently, I visited a site infected with the fake CAPTCHA spreading malware. I posted about it on altcoinstalks. I wasn't a victim of this attack because I immediately recognized it as a malware attempt.

    While these instructions may seem harmless enough, if you follow the steps you will actually be infecting yourself with malware—most likely an information stealer. In the background, the website you visited copied a command to your clipboard. In Chromium based browsers (which are almost all the popular ones) a website can only write to your clipboard with your permission. But Windows was under the assumption that you agreed to that when you checked the checkbox in the first screen.

    What the obstructions in the prompt are telling you to do is:

    1 - Open the Run dialog box on Windows.
    2 - Paste the content of your clipboard into that dialog box.
    3 - Execute the command you just pasted.
    They are not lying about what you will “observe”, but what they don’t tell you is that that’s only the last part of what you pasted, and what you are seeing is not really part of the command but just a comment added behind it.

    But under normal circumstances, this is what will be visible.

    After doing some research, I found a study by Malwarebytes anti-malware highlighting this deceptive tactic and providing tips on simple measures to counteract this type of attack: https://www.malwarebytes.com/blog/news/2025/03/fake-captcha-websites-hijack-your-clipboard-to-install-information-stealers

Page 1
Viewing Page: 1