Full Report
New variant of an old scam: Use the framing of a CAPTCHA to get an unsuspecting user to download and run a malicious program.
Analysis Summary
# Tool/Technique: Fake CAPTCHA Social Engineering
## Overview
This technique involves a social engineering lure that mimics a standard CAPTCHA verification interface. The purpose is to deceive users into manually executing commands or downloading malicious payloads under the guise of proving they are human. Recent variants focus on tricking users into using the "Run" command or PowerShell to bypass automated browser security warnings.
## Technical Details
- **Type**: Social Engineering Technique / Malware Delivery Vector
- **Platform**: Cross-platform (Windows, macOS, Linux) via Web Browsers
- **Capabilities**: Bypasses browser "Safe Browsing" protections, facilitates initial access, evades automated sandbox detection by requiring human interaction.
- **First Seen**: Variants of this scam have existed for years; the specific "Copy-Paste-Run" variant rose to prominence in 2024 (Article date cited as 2026).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- T1059.001 - Command and Scripting Interpreter: PowerShell
- **TA0005 - Defense Evasion**
- T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass (via manual command entry)
## Functionality
### Core Capabilities
- **Visual Deception**: Displays an interface identical to Google reCAPTCHA or Cloudflare Turnstile.
- **Instructional Fraud**: Provides step-by-step instructions (e.g., "Press Win + R, Ctrl + V, then Enter") to bypass security warnings that would normally trigger during a standard file download.
- **Clipboard Hijacking**: Automatically copies a malicious PowerShell command to the user's clipboard so they can "paste" it into a terminal or Run box.
### Advanced Features
- **Browser-to-OS Bridge**: By forcing the user to interact with the OS directly (Run box), the malware bypasses browser-level sandboxing and "Mark-of-the-Web" (MotW) flags.
- **Dynamic Payloads**: The CAPTCHA page can serve different scripts based on the user's User-Agent (detecting Windows vs. Mac).
## Indicators of Compromise
*Note: Specific hashes and domains vary by campaign.*
- **File Names**: `Fix_Captcha.exe`, `Verification.zip`, `SecurityCheck.ps1`
- **Network Indicators**:
- `hxxps[:]//captcha-verify[.]com`
- `hxxps[:]//clodflare-check[.]top`
- **Behavioral Indicators**:
- Unexpected `powershell.exe` execution with Base64 encoded commands originating from `explorer.exe`.
- Unusual usage of `cmd.exe /c start` commands initiated by the user.
## Associated Threat Actors
- **LUMMAC** (Lumma Stealer)
- **TA571** (Known for using complex delivery chains)
- **ClearFake** (Campaign known for fake updates and CAPTCHAs)
## Detection Methods
- **Behavioral detection**: Monitor for PowerShell or CMD processes spawned with encoded arguments immediately following browser activity.
- **Clipboard Monitoring**: Security tools can look for suspicious strings (e.g., `powershell -enc...`) being programmatically added to the system clipboard by a browser process.
- **EDR/SIEM**: Alert on `Win+R` (Run dialog) followed by execution of system utilities like `mshta.exe`, `powershell.exe`, or `certutil.exe`.
## Mitigation Strategies
- **User Education**: Train users to recognize that legitimate CAPTCHAs never require keyboard shortcuts (Win+R) or pasting commands into a terminal.
- **Attack Surface Reduction**: Disable or restrict PowerShell for non-administrative users.
- **AppLocker/Windows Defender Application Control (WDAC)**: Prevent unauthorized scripts from running, even if manually initiated by the user.
- **Browser Security**: Deploy robust web filtering and block newly registered domains (NRDs).
## Related Tools/Techniques
- **Clickjacking**: Overlapping transparent layers to trick users into clicking hidden buttons.
- **Browser Update Scams**: Similar social engineering using "Outdated Browser" warnings.
- **HTML Smuggling**: Hiding malicious payloads within HTML files to bypass network gateways.