Multiple real-world intrusions used a ClickFix-style lure where victims visiting compromised websites saw fake CAPTCHA prompts and were tricked into running a command themselves. Separately, attackers also abused the legitimate, signed Node.js runtime (node.exe) to run malicious JavaScript while appearing like normal developer activity. The campaigns affected a wide range of organizations, including government, technology, hotels, fintech, and other businesses.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You land on a normal site, and a CAPTCHA pops up: “Please verify you are not a robot. Follow the steps below to continue.” This is ClickFix. The page tells you to copy a long command and paste it into Windows Run or Windows Terminal. When you do, it quietly pulls down malware and runs it using the legit Node.js runtime, node.exe, so it looks like normal developer activity. GuidePoint has seen at least 31 organizations hit this way, government, tech, hotels, even a U.S. fintech, just by visiting compromised sites with this fake CAPTCHA or “fix this error” box. A real website will never ask you to run a command to prove you’re not a bot. If any page tells you to paste something into Windows Run or Terminal, stop immediately and report it to Security.
A state-sponsored campaign in South Korea used spear-phishing and hacked “trusted” local websites to infect visitors who had vulnerable AnySign4PC installed. In some cases, simply visiting a compromised page triggered the exploit and installed SIGNBT or COPPERHEDGE backdoors without any download…
Researchers found a criminal operation (StopAndProtect) that used nearly 2,000 hacked WordPress sites as a delivery network. Visitors were shown a fake CAPTCHA that pressured them to copy and run a PowerShell command, which then installed malware that could steal data, capture screenshots, and…
Researchers reported four separate espionage groups using the same “BlueMoon” exploit kit within days, targeting organizations in the US and Southeast Asia. The attacks began with phishing emails that lured recipients to attacker-controlled websites, where Chrome and Windows vulnerabilities were…
Researchers described a real cybercrime operation (“StopAndProtect”) that compromised nearly 2,000 WordPress sites and used them to show fake CAPTCHA pages that trick visitors into running malicious commands. Victims can end up with malware that steals files and screenshots and, in some cases,…
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
A China-nexus threat group targeted government and policy organizations across Asia using spear-phishing emails tailored to the victim’s interests. The emails used spoofed trusted senders and a realistic fake Gmail attachment preview that linked to attacker-controlled pages, ultimately installing…
