Researchers reported real-world campaigns using two new loaders (WordlistLoader and SynkLoader) to trick employees into running malicious installers or commands. One campaign uses a fake CAPTCHA (“ClickFix”) on compromised websites to get users to paste and run a Windows command; another uses Microsoft Teams messages impersonating an IT Service Desk to convince a user to install an MSI that ultimately steals Windows login passwords via a fake lock screen.
Two separate loaders, WordlistLoader and SynkLoader, were used in real-world campaigns that relied on social engineering rather than malicious attachments. In the first, compromised but legitimate websites displayed a fake CAPTCHA prompt. When a visitor clicked the "I'm not a robot" checkbox, a malicious command was silently copied to their clipboard, and the page instructed them to paste it into the Windows Run dialog and execute it. Some of these campaigns rotated malicious code through jsDelivr and blockchain-hosted content to avoid takedown.
In the second scenario, an attacker impersonating an internal IT Service Desk reached out to a target through a Microsoft Teams message. The message persuaded the user to download and install an MSI installer hosted on a Microsoft Azure blob storage endpoint, a detail that made the file appear to come from Microsoft itself. Once installed, SynkLoader deployed a module called PhishLocker that displayed a fake Windows lock screen to capture the victim's login password.
Both scenarios worked by borrowing the appearance of routine, trusted processes. A CAPTCHA is something users complete dozens of times a day without thinking, so an unusual instruction folded into that flow can slip past scrutiny. Likewise, a Teams message from someone claiming to be IT Service Desk exploits the trust employees place in internal support channels. Hosting the installer on a well-known cloud storage domain added a further layer of apparent legitimacy, since the URL looked like it belonged to a Microsoft-hosted resource.
Employees should be trained to treat CAPTCHA prompts that request command execution as an immediate red flag and to report them rather than comply. IT support requests received over chat should always be verified through an official channel before any software is installed, and staff should understand that a familiar-looking cloud storage domain does not guarantee a file is safe. Finally, any fake lock screen or unusual re-authentication prompt should be reported right away, since it may be an attempt to capture Windows login credentials.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a social engineering trick where a fake CAPTCHA on a compromised website copies a malicious command to the clipboard and instructs the visitor to paste it into the Windows Run dialog and execute it, believing they are completing verification.
An attacker impersonating an IT Service Desk contacted a target over Teams and convinced them to download and install an MSI installer hosted on a Microsoft Azure blob storage endpoint, which made the file look like it came from Microsoft.
A module called PhishLocker displays a fake Windows lock screen designed to capture the victim's Windows login password after the malware has already been installed.
It combines legitimate-website compromise, cloud-hosted malicious code, an internal chat channel impersonation, and a credential-harvesting fake lock screen, all without relying on a traditional malicious email attachment.
You’re on a normal website, click “I’m not a robot”… and it tells you to run a Windows command. That’s not a CAPTCHA, that’s malware. This is the ClickFix, or FakeCaptcha, trick used by WordlistLoader. Compromised real sites inject JavaScript so when you click the box, a malicious command silently copies to your clipboard and the page walks you through pasting it into Windows Run. Same play in Teams: a chat pops up, “Hi, IT Service Desk here. Please install this PowerShell Cleaner to fix an issue.” The link is an MSI on blob.core.windows.net. If you run it, SynkLoader can drop a fake Windows lock screen, PhishLocker, to capture your login password. Aha moment: real CAPTCHAs and real IT will never tell you to paste commands or install tools from chat. If anything online tells you to do that, stop immediately and report it to IT Security.
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
AI firm ORO says a suspected North Korean attacker hijacked a real conference contact’s Telegram account and lured an employee into joining a fake Microsoft Teams call link. After the call “had no working audio,” the victim approved what looked like a Teams update, which installed a malicious…
Researchers linked DigiCert’s April 2026 breach to a GoldenEyeDog sub-group that tricked support staff into running a malicious file delivered through a customer support chat. The attackers then abused DigiCert’s support portal features to intercept EV code-signing certificate “initialization…
