Researchers reported real-world campaigns using two new loaders (WordlistLoader and SynkLoader) to trick employees into running malicious installers or commands. One campaign uses a fake CAPTCHA (“ClickFix”) on compromised websites to get users to paste and run a Windows command; another uses Microsoft Teams messages impersonating an IT Service Desk to convince a user to install an MSI that ultimately steals Windows login passwords via a fake lock screen.
Two separate loaders, WordlistLoader and SynkLoader, were used in real-world campaigns that relied on social engineering rather than malicious attachments. In the first, compromised but legitimate websites displayed a fake CAPTCHA prompt. When a visitor clicked the "I'm not a robot" checkbox, a malicious command was silently copied to their clipboard, and the page instructed them to paste it into the Windows Run dialog and execute it. Some of these campaigns rotated malicious code through jsDelivr and blockchain-hosted content to avoid takedown.
In the second scenario, an attacker impersonating an internal IT Service Desk reached out to a target through a Microsoft Teams message. The message persuaded the user to download and install an MSI installer hosted on a Microsoft Azure blob storage endpoint, a detail that made the file appear to come from Microsoft itself. Once installed, SynkLoader deployed a module called PhishLocker that displayed a fake Windows lock screen to capture the victim's login password.
Both scenarios worked by borrowing the appearance of routine, trusted processes. A CAPTCHA is something users complete dozens of times a day without thinking, so an unusual instruction folded into that flow can slip past scrutiny. Likewise, a Teams message from someone claiming to be IT Service Desk exploits the trust employees place in internal support channels. Hosting the installer on a well-known cloud storage domain added a further layer of apparent legitimacy, since the URL looked like it belonged to a Microsoft-hosted resource.
Employees should be trained to treat CAPTCHA prompts that request command execution as an immediate red flag and to report them rather than comply. IT support requests received over chat should always be verified through an official channel before any software is installed, and staff should understand that a familiar-looking cloud storage domain does not guarantee a file is safe. Finally, any fake lock screen or unusual re-authentication prompt should be reported right away, since it may be an attempt to capture Windows login credentials.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a social engineering trick where a fake CAPTCHA on a compromised website copies a malicious command to the clipboard and instructs the visitor to paste it into the Windows Run dialog and execute it, believing they are completing verification.
An attacker impersonating an IT Service Desk contacted a target over Teams and convinced them to download and install an MSI installer hosted on a Microsoft Azure blob storage endpoint, which made the file look like it came from Microsoft.
A module called PhishLocker displays a fake Windows lock screen designed to capture the victim's Windows login password after the malware has already been installed.
It combines legitimate-website compromise, cloud-hosted malicious code, an internal chat channel impersonation, and a credential-harvesting fake lock screen, all without relying on a traditional malicious email attachment.
You’re on a normal website, click “I’m not a robot”… and it tells you to run a Windows command. That’s not a CAPTCHA, that’s malware. This is the ClickFix, or FakeCaptcha, trick used by WordlistLoader. Compromised real sites inject JavaScript so when you click the box, a malicious command silently copies to your clipboard and the page walks you through pasting it into Windows Run. Same play in Teams: a chat pops up, “Hi, IT Service Desk here. Please install this PowerShell Cleaner to fix an issue.” The link is an MSI on blob.core.windows.net. If you run it, SynkLoader can drop a fake Windows lock screen, PhishLocker, to capture your login password. Aha moment: real CAPTCHAs and real IT will never tell you to paste commands or install tools from chat. If anything online tells you to do that, stop immediately and report it to IT Security.
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
