Tag: captcha
-
Decades-Old Windows Utility Powers Modern ClickFix Attack
The attack uses malicious Google search results related to Amazon and leverages the ‘finger’ utility to launch a CAPTCHA that installs malware, including the Lumma stealer. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/decades-old-windows-utility-modern-clickfix-attack
-
Gefälschte CAPTCHAs: Wenn »Ich bin kein Roboter« zur Malware-Falle wird
Gefälschte CAPTCHAs sehen vertraut aus und genau das macht sie gefährlich. In Verbindung mit ClickFix-Techniken bringen sie Nutzer dazu, schädliche Befehle selbst auszuführen. Unternehmen müssen deshalb technische Kontrollen, Awareness und klare Meldewege enger zusammendenken. Management Summary CAPTCHA als Tarnkappe: Angreifer nutzen vertraute Verifizierungsdialoge, um Phishing-Seiten glaubwürdig erscheinen zu lassen und automatisierte Prüfungen zu erschweren…. First…
-
Fake CAPTCHAs are tricking users into running malware on their own devices
Fake CAPTCHA checks are being used to do more than hide phishing pages. Attackers are turning the familiar “prove you’re human” step into a gateway for malware downloads, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/15/barracuda-fake-captcha-phishing-attacks/
-
Microsoft Warns ClickFix Attacks Use Fake CAPTCHA Lures to Execute Malicious Commands
Microsoft Threat Intelligence has identified a ClickFix campaign in which compromised websites use fake CAPTCHA-style verification prompts to trick Windows users into executing malicious commands. The operation stages its payload inside the browser cache before the victim runs the command, helping attackers evade conventional download-based detection and work around Windows Run dialog character limits. The…
-
Malicious Custom GPT on chatgpt.com lures users into installing a RAT
Malware peddlers are using sponsored Google results to push a malicious ChatGPT Custom GPT named >>Plus 5.6,<< created to lead users to a fake Cloudflare CAPTCHA … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/29/malicious-chatgpt-custom-gpt-malware-via-clickfix/
-
Psychedelic Stealer greift ukrainische Nutzer an
Tags: captchaArctic Wolf Labs deckt eine Kampagne auf, bei der gekaperte ukrainische Websites die Schadsoftware Psychedelic Stealer über ein gefälschtes CAPTCHA verbreiten. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/psychedelic-stealer-ukraine
-
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex.The new findings come from Ontinue, which described the activity as a four-stage attack chain aimed at targeting Ukrainian-speaking users.”The attack chain begins with a fake CAPTCHA page and First seen on…
-
ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer
Attackers hijacked Ukrainian websites to deliver a fake Cloudflare CAPTCHA that installs Psychedelic Stealer and steals browser and crypto credentials. Psychedelic Stealer is being distributed through compromised Ukrainian business websites. Attackers injected hidden iframes into legitimate pages and used them to display a fake Cloudflare verification screen to visitors. The affected sites included a hair-treatment…
-
BSI-Warnung: Berliner Landes-IT offenbar über Fake-Captcha gehackt
Nach dem Hackerangriff auf Berlin warnt das BSI vor den Methoden der Angreifer. Einstiegspunkt sind demnach betrügerische Captchas auf Webseiten. First seen on golem.de Jump to article: www.golem.de/news/bsi-warnung-berliner-landes-it-offenbar-ueber-fake-captcha-gehackt-2609-212711.html
-
An AI CAPTCHA solver talked itself out of the right answer
You have probably spent a few seconds of your life turning a picture until it lines up. Some sites, instead of asking you to tick a box, show you a circular chunk of a photo … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/02/ai-captcha-solver-research/
-
Microsoft warns of TerminalFix attacks deploying reverse tunnels
A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-warns-of-terminalfix-attacks-deploying-reverse-tunnels/
-
TerminalFix Uses Fake CAPTCHA, DLL Sideloading and Steganography to Breach Networks
A sophisticated ClickFix variant dubbed TerminalFix that uses fake Cloudflare CAPTCHA prompts to trick users into executing attacker-controlled PowerShell commands. Rather than delivering a conventional infostealer, the campaign builds persistent access and deploys a reverse-tunnel implant capable of turning an infected Windows endpoint into a proxy for reaching internal network resources The intrusion begins on…
-
Hackers Turn Trusted npm Mirrors Into Hosts for Fake Cloudflare ClickFix Pages.
Threat actors are abusing npm’s package-distribution ecosystem to host convincing fake Cloudflare verification pages on trusted mirror domains, turning developer infrastructure into a phishing delivery layer. OX Security said it identified 24 malicious npm packages containing identical HTML code designed to render a fake CAPTCHA page and redirect visitors to attacker-controlled infrastructure. The campaign does…
-
Hackers abuse npm mirrors to host phishing redirect pages
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-abuse-npm-mirrors-to-host-phishing-redirect-pages/
-
24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages.”While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn’t do harm, the threat actor’s use of npm isn’t to…
-
CAPTCHA Has Fallen Behind Biometric Check is Built for Today’s Traffic
Key Takeaways Most bot management vendors still fall back on CAPTCHA or SMS codes when traffic looks suspicious, friction that AI now defeats more reliably than the humans it was built to test. A 2023 UC Irvine study found bots solving CAPTCHA at 99.8% accuracy against a 5084% human range. CAPTCHA is a browser… First…
-
Hackers Use Fake CAPTCHA to Deploy Malware That Shuts Down Endpoint Security
Threat actors are pairing fake CAPTCHA verification pages with a commercial malware loader capable of disabling endpoint defenses, creating a high-impact infection chain that begins with a victim manually executing a malicious PowerShell command. In late July 2026, multiple ClickFix campaigns generated through the ErrTraffic malware-as-a-service platform and used to deliver Cruciferra, a loader advertised…
-
Gefälschte CAPTCHAs und gehackte WordPress-Seiten treiben neue Malware-Kampagne
Check Point deckt StopAndProtect auf: Mehr als 5.000 infizierte Rechner, 2.000 gehackte WordPress-Seiten und ClickFix-Angriffe per Fake-CAPTCHA. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/gefaelschte-captchas-und-gehackte-wordpress-seiten-treiben-neue-malware-kampagne/a46206/
-
Hackers Abuse Thousands of WordPress Sites to Spread StopAndProtect Malware via ClickFix
A large-scale malware operation called StopAndProtect is exploiting thousands of compromised WordPress websites to distribute ransomware, steal files, harvest credentials, and remotely monitor victims through deceptive ClickFix CAPTCHA prompts. Researchers first identified the campaign in mid-May 2026. They discovered that the operation utilizes a broad range of criminal tools rather than relying on a single…
-
Hackers Abuse Thousands of WordPress Sites to Spread StopAndProtect Malware via ClickFix
A large-scale malware operation called StopAndProtect is exploiting thousands of compromised WordPress websites to distribute ransomware, steal files, harvest credentials, and remotely monitor victims through deceptive ClickFix CAPTCHA prompts. Researchers first identified the campaign in mid-May 2026. They discovered that the operation utilizes a broad range of criminal tools rather than relying on a single…
-
Mac Malware Found Draining Crypto Wallets After Fake CAPTCHA Trick
Researchers at Huntress have uncovered a strain of macOS malware that can gradually siphon funds out of victims’ cryptocurrency wallets, after tracing an infection back to a fake CAPTCHA scam known as ClickFix. The incident came to light during a retrospective threat hunt in June 2026, when a Huntress analyst discovered remnants of a Mac-specific…
-
Ukraine warns fake CAPTCHAs are being used to make you hack yourself
Ukraine’s computer emergency response team, CERT-UA, has warned that the Kremlin-backed Sandworm hacking group is leveraging fake CAPTCHA checks on compromised websites that persuade users to run malicious code. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/ukraine-fake-captchas-hack-yourself
-
UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware
Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines with data-stealing malware.According to the Computer Emergency Response Team of Ukraine (CERT-UA), the activity has been attributed to UAC-0145, a sub-cluster within Sandworm, an advanced hacking unit affiliated with GRU, Russia’s First seen on…
-
Sandworm hackers have a CAPTCHA trick for Ukrainians
Rather than verifying they are human, the CAPTCHA users are instructed to copy and paste a PowerShell command into their Windows computers. First seen on therecord.media Jump to article: therecord.media/ukraine-sandworm-hacks-captcha-powershell
-
KI-gestützte Bot-Abwehr ersetzt CAPTCHAs durch kontinuierliche Verhaltensanalyse
Cloudflare hebt die Bot-Abwehr auf eine neue Stufe. Mit <> präsentiert der Connectivity-Cloud-Anbieter eine neue Sicherheitslösung, die automatisierte Angriffe anhand des Nutzerverhaltens erkennt und dabei vollständig auf klassische CAPTCHAs verzichten kann. Statt einzelne Anfragen zu prüfen, analysiert Precursor das Verhalten von Besuchern während einer kompletten Sitzung und soll so auch hochentwickelte KI-Bots und automatisierte […]…
-
SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users
A new banking fraudulent operation is targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges using ClickFix lures.The activity cluster, tracked by Elastic Security Labs under the moniker REF6045, involves infecting victims through fake CAPTCHA verification pages that deceive them into running a malicious command that installs a PowerShell toolkit dubbed First seen…
-
Cloudflare PACT: Neuer Privacy-Standard gegen Bots, Captchas und KI-Traffic im Internet
PACT steht für Private Access Control Tokens. Dabei handelt es sich um ein geplantes, datenschutzorientiertes Protokoll, mit dem Browser gegenüber Websites Vertrauenssignale übermitteln können First seen on infopoint-security.de Jump to article: www.infopoint-security.de/cloudflare-pact-neuer-privacy-standard-gegen-bots-captchas-und-ki-traffic-im-internet/a45560/
-
Pakt für PACT Cloudflare und Browser-Hersteller entwickeln Datenschutz-Protokoll für das Internet
Datenschutz soll künftig direkt in die Infrastruktur des Internets eingebaut werden. Cloudflare hat gemeinsam mit führenden Browser-Herstellern wie Mozilla, Google, Microsoft und Shopify die Entwicklung eines neuen, datenschutzorientierten Internet-Protokolls angekündigt. Private-Access-Control-Tokens (PACT). Das Verfahren soll Websites helfen, legitime Nutzer und autorisierte KI-Agenten von schädlichem automatisiertem Traffic zu unterscheiden ganz ohne aufdringliche Captchas, Zwangs-Logins oder […]…