Cisco Talos investigated a real infection chain seen at a Ukrainian government organization where a disguised DLL was executed directly from a WebDAV network path. Attackers used a compromised website to show a fake Google CAPTCHA-style “verification” prompt that tricks users into running a copied command, which then downloads and executes the Amatera stealer and follow-on payloads (including NetSupport Manager). The campaign appears focused on stealing credentials and cryptocurrency data, with one branch assessed as linked to a Russian threat actor.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re browsing a normal site and a Google‑style CAPTCHA pops up: “Prove you’re human. Press Win+R and run this command.” That’s a real attack Cisco Talos saw: the fake CAPTCHA copies a command, you paste it into Windows Run, and it silently opens a WebDAV path on leaguejazire dot com to run a disguised DLL called verification.google, dropping the Amatera stealer and even NetSupport remote access. On macOS, the same trick tells you to open Terminal and paste a curl command to riyazinikokar dot xyz. Here’s the aha: real CAPTCHAs never ask you to use Windows Run or Terminal. If a “verification” needs a command line, it’s not verification, it’s malware delivery. If any CAPTCHA or “verification” tells you to open Windows Run or Terminal and paste a command, stop immediately and report it to Security, don’t run it, just screenshot it and send it in.
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Researchers report a real, active malware operation where compromised websites use “ClickFix” style prompts to trick people into manually pasting and running malicious commands. The result is a multi-stage infection that downloads additional payloads and ultimately runs TELEPUZ, which can steal…
Researchers observed an active campaign where attackers used Microsoft Teams to impersonate IT support and trick a user into running a PowerShell command. That action downloaded a malicious package that enabled credential theft (via a fake lock screen) and helped attackers move through internal…
Ukraine’s CERT says the Russia-linked Sandworm group is tricking targets into infecting their own PCs using compromised websites that display fake CAPTCHA checks. Victims are instructed to copy and paste a PowerShell command, which downloads malware and can lead to deeper compromise. CERT also…
Microsoft reported a real-world campaign (“TerminalFix”) where attackers use compromised websites to show a fake Cloudflare CAPTCHA. The prompt tricks visitors into copying and running a malicious PowerShell/Terminal command, which then installs a reverse-tunnel backdoor that can give attackers…
A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then…
