Cisco Talos investigated a real infection chain seen at a Ukrainian government organization where a disguised DLL was executed directly from a WebDAV network path. Attackers used a compromised website to show a fake Google CAPTCHA-style “verification” prompt that tricks users into running a copied command, which then downloads and executes the Amatera stealer and follow-on payloads (including NetSupport Manager). The campaign appears focused on stealing credentials and cryptocurrency data, with one branch assessed as linked to a Russian threat actor.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re browsing a normal site and a Google‑style CAPTCHA pops up: “Prove you’re human. Press Win+R and run this command.” That’s a real attack Cisco Talos saw: the fake CAPTCHA copies a command, you paste it into Windows Run, and it silently opens a WebDAV path on leaguejazire dot com to run a disguised DLL called verification.google, dropping the Amatera stealer and even NetSupport remote access. On macOS, the same trick tells you to open Terminal and paste a curl command to riyazinikokar dot xyz. Here’s the aha: real CAPTCHAs never ask you to use Windows Run or Terminal. If a “verification” needs a command line, it’s not verification, it’s malware delivery. If any CAPTCHA or “verification” tells you to open Windows Run or Terminal and paste a command, stop immediately and report it to Security, don’t run it, just screenshot it and send it in.
Attackers registered a long-used “placeholder” domain (third-party[.]com) that appears in developer documentation and code examples, then used it to trick Windows visitors with a fake Cloudflare-style verification page. The site tries to convince people to open the Windows Run box and paste a…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
A China-nexus threat group targeted government and policy organizations across Asia using spear-phishing emails tailored to the victim’s interests. The emails used spoofed trusted senders and a realistic fake Gmail attachment preview that linked to attacker-controlled pages, ultimately installing…
Researchers observed real-world infections where compromised WordPress sites showed a fake “Cloudflare Turnstile” verification and instructed visitors to press Win+R and run a PowerShell command. The attacker’s page guides victims step-by-step (and reports progress back to the operator) to execute…
Researchers report a real, active malware operation where compromised websites use “ClickFix” style prompts to trick people into manually pasting and running malicious commands. The result is a multi-stage infection that downloads additional payloads and ultimately runs TELEPUZ, which can steal…
Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…
