Fake CAPTCHA Trick Fuels WebDAV Malware Chain

How the attack worked

Cisco Talos investigated an incident at a Ukrainian government organization and uncovered what it described as a complex WebDAV infection chain. The activity is attributed to a Russian actor tracked as UAT-10820. Rather than relying on a malicious attachment or link alone, the campaign used a fake CAPTCHA or human-verification prompt on a website to manipulate users into copying and pasting a command into their own system. That single action kicked off the infection chain, ultimately delivering Amatera stealer, ZigCryptoStealer, and NetSupport Manager, along with a vulnerable driver capable of terminating EDR software and additional unauthorized remote access tools.

Why it succeeded

The technique worked because it exploited a familiar, low-friction interaction: verifying you are human on a website. Most users have been trained to click a checkbox or solve a simple puzzle for CAPTCHA checks, not to run commands. By dressing up the request as a routine verification step, attackers bypassed the skepticism that a more obviously suspicious email or download prompt might trigger. The campaign also abused legitimate infrastructure, such as the BNB Smart Chain for bulletproof hosting, which helped the malicious activity blend in and evade traditional web filters.

What to watch for

• A CAPTCHA or verification prompt that asks you to copy and paste a command rather than click a box or solve a puzzle
• Any website step that asks you to open a terminal, run a program, or paste text into your operating system to "continue"
• Pushy or unusual instructions framed as bypassing normal browser protections
• Unexpected remote access tools or software appearing on a system after visiting a site

Building resistance

Organizations, especially those in government and other sectors targeted by this kind of activity, should reinforce a simple rule: legitimate verification steps never require pasting commands into your computer. Awareness training should specifically call out this pattern, since it does not look like a typical phishing email and can catch users off guard on otherwise normal-looking websites.

Key takeaways for defenders:

• Train all employees, administrative staff, IT support, and security operations teams to recognize fake verification prompts as a distinct social engineering pattern
• Encourage users to report unexpected "human verification" steps to IT or security rather than following them
• Remind staff that attackers may use legitimate-looking platforms and infrastructure to make malicious activity appear trustworthy
• Pair this awareness with technical controls, since the campaign also involved tools designed to disable endpoint defenses once execution succeeds

This incident is a reminder that social engineering keeps evolving beyond email, and that browser-based interactions deserve the same scrutiny as suspicious messages.

What is the fake CAPTCHA attack technique?

Attackers show a fake human-verification prompt that instructs the user to copy and paste a command to continue, which actually runs malicious code on their machine.

What malware was delivered in this campaign?

The chain delivered Amatera stealer, ZigCryptoStealer, and NetSupport Manager, along with a vulnerable driver used to terminate EDR software and additional remote access tools.

Who was targeted in this attack?

Cisco Talos investigated an incident at a Ukrainian government organization, with the activity attributed to a Russian actor tracked as UAT-10820.

How can organizations train users to spot this attack?

Teach staff that legitimate CAPTCHA checks never require copying and pasting commands, and encourage reporting of unexpected verification steps to IT or security teams.