Скачать или смотреть Fake CAPTCHA Attacks Spread Infostealers and RATs Through Multistage Payload Chains

Research reveals a surge in fake CAPTCHA pages designed to trick Windows users into pasting malicious commands into the Run dialog. Delivered via phishing, malvertising, or SEO poisoning, these campaigns use obfuscated JavaScript embedded in files like MP3s and PDFs to execute payloads in-memory through mshta.exe or PowerShell, evading traditional detection.
The malware suite includes Lumma Stealer, Rhadamanthys, AsyncRAT, Emmental, and XWorm, enabling credential theft, data exfiltration, remote access, and persistent backdoors. Attackers exploit trusted CAPTCHA interfaces and legitimate platforms such as file-sharing services and content repositories.
Windows environments with weak script restrictions are most vulnerable. Mitigation strategies include disabling the Run dialog, restricting file-sharing access, and hardening browser settings. Trend Vision One™ customers benefit from built-in detection, threat hunting, and intelligence on these evolving threats.

#FakeCAPTCHA #Infostealers #RAT #Malware #LummaStealer #AsyncRAT #Cybersecurity #ThreatIntel #Phishing #Malvertising #PowerShell #Mshta #TrendMicro #WindowsSecurity #EndpointSecurity #C2 #DataExfiltration #CyberThreats