Collecting Cyber-News from over 60 sources

Tag: captcha

6 ways hackers hide their tracks

Aug 7, 2025 10:11 AM

Tags: access, ai, antivirus, api, attack, backdoor, breach, captcha, ceo, computer, control, credentials, crypto, cybersecurity, data, data-breach, defense, detection, email, endpoint, exploit, github, hacker, injection, intelligence, jobs, law, linux, LLM, login, malicious, malware, monitoring, network, open-source, openai, phishing, programming, RedTeam, resilience, reverse-engineering, risk, rust, service, social-engineering, software, supply-chain, threat, tool, virus, windows

Backdoors in legitimate software libraries: In April 2024, it was revealed that the XZ Utils library had been covertly backdoored as part of years-long supply-chain compromise effort. The widely used data compression library that ships as a part of major Linux distributions had malicious code inserted into it by a trusted maintainer.Over the last decade,…
OAuth-Apps für M365-Phishing missbraucht

Aug 4, 2025 7:28 PM

Tags: access, adobe, authentication, business, captcha, cloud, cyberattack, fido, identity, login, mail, malware, mfa, microsoft, password, phishing

Gefälschte OAuth-Apps eröffnen Angreifern neue Wege, um Microsoft-Konten zu kapern.Bedrohungsakteure haben einen neuen, smarten Weg aufgetan, Microsoft-365-Konten zu kompromittieren. Wie Proofpoint herausgefunden hat, erstellen sie dazu zunehmend gefälschte OAuth-Anwendungen, die vertrauenswürdige Brands wie SharePoint und DocuSign imitieren. Die “Originale” dieser Apps nutzen die Identity-Plattform von Microsoft (Azure AD / Entra ID), um auf Daten aus…
Phishing Attack Spoofs Facebook Login Page to Capture Credentials

Jul 25, 2025 2:27 PM

Tags: attack, captcha, credentials, cyber, cybercrime, login, malicious, phishing, tactics

Cybercriminals are using a variety of dishonest tactics in a sophisticated phishing effort aimed at Facebook users in order to obtain login information. The attack begins with a malicious redirect that leads victims to a fraudulent website mimicking legitimate Facebook interfaces. Here, users encounter a fake CAPTCHA prompt designed to appear as a standard security…
UNG0002 Actors Weaponize LNK Files via ClickFix Fake CAPTCHA Pages

Jul 17, 2025 2:40 PM

Tags: captcha, china, cyber, cybersecurity, espionage, group, malware, social-engineering, threat

Cybersecurity researchers at Seqrite Labs have identified a sophisticated espionage group designated as UNG0002 (Unknown Group 0002) that has been conducting persistent campaigns across multiple Asian jurisdictions since May 2024. The threat actors have demonstrated remarkable adaptability by integrating social engineering techniques with advanced malware deployment methods, specifically targeting organizations in China, Hong Kong, and…
Rhadamanthys Infostealer Uses ClickFix Technique to Steal Login Credentials

Jul 10, 2025 1:40 PM

Tags: captcha, credentials, cyber, cybersecurity, login, malicious, virus

The Rhadamanthys Stealer, a highly modular information-stealing virus that was first discovered in 2022, has made a comeback with a clever and dishonest delivery method called ClickFix Captcha. This is a terrifying development for cybersecurity experts. This technique disguises malicious payloads behind seemingly legitimate CAPTCHA interfaces, tricking users into executing sophisticated malware. Leverages CAPTCHA Disguise…
Neuer Rust-basierter Infostealer entdeckt – Warnung vor ‘EddieStealer” mit Tarnung als CAPTCHA-Prüfung

Jul 3, 2025 8:34 AM

Tags: captcha, rust

First seen on security-insider.de Jump to article: www.security-insider.de/neue-malware-eddiestealer-angriffe-auf-windows-systeme-via-captcha-seiten-a-eb4c4cafde7ac6eea4c7cf08b8f0e6c8/
CAPTCHAs 101: what they are, how they work, and where they fall short

Jul 1, 2025 2:34 PM

Tags: captcha, service

CAPTCHAs are the most recognizable anti-bot mechanism on the web. Whether you’re logging into a game, signing up for a new service, or checking out online, chances are you’ve been asked to click on traffic lights, solve a puzzle, or interpret distorted letters. These tests”, First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/captchas-101-what-they-are-how-they-work-and-where-they-fall-short/
More Support for Complex Authentication Flows: TOTP MFA and Text-Based CAPTCHA

Jun 30, 2025 6:33 PM

Tags: authentication, captcha, mfa

Escape’s new support for TOTP MFA and text-based CAPTCHA enables fully automated DAST on protected apps, reducing scan failures First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/06/more-support-for-complex-authentication-flows-totp-mfa-and-text-based-captcha/
Lunar Spider Lotus V2 Loader Campaign Using Fake CAPTCHA Delivery and DLL Sideloading

Jun 27, 2025 12:36 PM

Tags: captcha, cybercrime, finance, fraud, group

Lunar Spider is a financially motivated cybercrime group that has been active since at least 2017. The group primarily engages in financial fraud and access First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2025/06/27/lunar-spider-lotus-v2-loader-campaign-using-fake-captcha-delivery-and-dll-sideloading/
New FileFix Method Emerges as a Threat Following 517% Rise in ClickFix Attacks

Jun 26, 2025 5:36 PM

Tags: access, attack, captcha, data, exploit, ransomware, social-engineering, threat, tool

The ClickFix social engineering tactic as an initial access vector using fake CAPTCHA verifications increased by 517% between the second half of 2024 and the first half of this year, according to data from ESET.”The list of threats that ClickFix attacks lead to is growing by the day, including infostealers, ransomware, remote access trojans, cryptominers,…
Kasada and Vercel Launch BotID: Invisible Bot Protection, Built for Developers

Jun 26, 2025 5:36 AM

Tags: captcha, fraud, login

Now millions of developers can easily and effectively protect high-value app flows like login and checkout from bot-driven fraud, without CAPTCHAs First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/06/kasada-and-vercel-launch-botid-invisible-bot-protection-built-for-developers/
The Best CAPTCHA is No CAPTCHA: Introducing Vercel BotID, Powered by Kasada

Jun 26, 2025 5:36 AM

Tags: captcha, threat

We’re excited to partner with Vercel to launch a seamless, CAPTCHA-free bot protection to stop modern threats and preserve the user experience. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/06/the-best-captcha-is-no-captcha-introducing-vercel-botid-powered-by-kasada/
How bot detection misfires on non-mainstream browsers and privacy tools

Jun 17, 2025 4:54 PM

Tags: browser, captcha, detection, hacker, privacy, tool, vpn

Every time there’s a Hacker News thread about bots, bot detection, or CAPTCHAs, a familiar complaint shows up: people using VPNs, ad blockers, Firefox forks, or privacy tools get bombarded with CAPTCHAs or blocked entirely. It feels like modern anti-bot systems are punishing users just for trying to First seen on securityboulevard.com Jump to article:…
Why We’re Going All In on Application Protection – Impart Security

Jun 10, 2025 12:55 AM

Tags: access, ai, application-security, attack, business, captcha, container, control, cybersecurity, detection, framework, infrastructure, intelligence, monitoring, network, programming, risk, software, startup, threat, tool, update, vulnerability

When we started Impart, the cybersecurity world was obsessed with visibility. Every startup was racing to build the next agentless monitoring platform, building broad sets of product features across multiple areas while carefully sidestepping the unglamorous reality of actually securing anything. Coming from the world of WAF in the trenches of real security enforcement, this felt…
ClickFix Attack Uses Fake Cloudflare Verification to Silently Deploy Malware

Jun 6, 2025 5:54 PM

Tags: attack, captcha, cyber, exploit, malicious, malware, phishing, powershell, social-engineering, threat

A newly identified social engineering attack dubbed >>ClickFix
ClickFix Attack Uses Fake Cloudflare Verification to Silently Deploy Malware

Jun 6, 2025 5:54 PM

Tags: attack, captcha, cyber, exploit, malicious, malware, phishing, powershell, social-engineering, threat

A newly identified social engineering attack dubbed >>ClickFix
New phishing campaign hijacks clipboard via fake CAPTCHA for malware delivery

Jun 6, 2025 2:54 PM

Tags: attack, captcha, endpoint, exploit, Internet, korea, malware, north-korea, phishing, spam, tactics, tool

Fail-proof exploit of ‘verification fatigue’: SlashNext highlighted that the campaign’s success stems largely from its exploitation of human psychology.”Modern internet users are inundated with spam checks, CAPTCHAs, and security prompts on websites, and they’ve been conditioned to click through these as quickly as possible,” Kelley added. “Attackers exploit this ‘verification fatigue,’ knowing that many users…
Neuer Infostealer tarnt sich mit gefälschtem CAPTCHA

Jun 6, 2025 12:55 PM

Tags: captcha, crypto, malware, powershell

Security-Analysten warnen vor einer neuartigen Malware-Kampagne: EDDIESTEALER nutzt überzeugend inszenierte CAPTCHA-Köder, um Nutzer zur Ausführung gefährlicher PowerShell-Befehle zu verleiten. Ziel ist es, Zugangsdaten, Krypto-Wallets und Browserdaten abzugreifen. First seen on itsicherheit-online.com Jump to article: www.itsicherheit-online.com/news/cybersecurity/neuer-infostealer-tarnt-sich-mit-gefaelschtem-captcha/
Threat Actors Abuse ‘Prove You Are Human’ System to Distribute Malware

Jun 4, 2025 10:54 AM

Tags: attack, captcha, cyber, exploit, malicious, malware, powershell, tactics, threat, windows

Threat actors have been found exploiting the ubiquitous >>Prove You Are Human
Interlock and the Kettering Ransomware Attack: ClickFix’s Persistence

Jun 3, 2025 4:54 PM

Tags: access, attack, breach, captcha, ciso, computer, control, credentials, cyberattack, data, data-breach, detection, endpoint, exploit, group, healthcare, HIPAA, incident response, injection, malicious, mobile, network, phishing, powershell, ransom, ransomware, risk, saas, service, technology, threat, tool, vulnerability

In healthcare, every minute of downtime isn’t just a technical problem”Š”, “Šit’s a patient safety risk. CNN recently reported that Kettering Health, a major hospital network in Ohio, was hit by a ransomware attack. According to CNN, the Interlock ransomware group claimed responsibility, sending a chilling reminder that healthcare remains a prime target for this particular…
Threat Actors Target PerimeterX CAPTCHA to Automate Microsoft Account Creation

Jun 3, 2025 11:54 AM

Tags: captcha, cyber, cybercrime, exploit, fraud, microsoft, threat

A recent post on an underground forum has brought renewed attention to the escalating arms race between cybercriminals and anti-bot security vendors. The solicitation, offering USD 1,500 for a working bypass of PerimeterX (PX) anti-fraud protections”, specifically targeting the “hold CAPTCHA” on Microsoft’s signup.live.com”, highlights the growing commoditization and sophistication of CAPTCHA evasion toolkits. Exploiting…
Threat Actors Leverage ClickFix Technique to Deploy EddieStealer Malware

Jun 2, 2025 9:54 PM

Tags: attack, captcha, cyber, cybersecurity, data, malicious, malware, rust, social-engineering, tactics, threat

Cybersecurity researchers have identified a sophisticated malware campaign utilizing deceptive CAPTCHA interfaces to distribute EddieStealer, a Rust-based information stealing malware that targets sensitive user data across multiple platforms. The attack employs the ClickFix technique, tricking victims into executing malicious commands through fake verification prompts, representing a significant evolution in social engineering tactics used by cybercriminals.…
HuluCaptcha: Fake Captcha Kit Tricks Users into Executing Code via Windows Run Command

Jun 2, 2025 2:54 PM

Tags: attack, captcha, cyber, exploit, malicious, phishing, windows

Security researchers have identified a sophisticated phishing campaign leveraging a fake CAPTCHA verification system dubbed >>HuluCaptcha
New EDDIESTEALER Malware Bypasses Chrome’s App-Bound Encryption to Steal Browser Data

May 30, 2025 5:55 PM

Tags: browser, captcha, chrome, data, encryption, malicious, malware, powershell, rust, social-engineering

A new malware campaign is distributing a novel Rust-based information stealer dubbed EDDIESTEALER using the popular ClickFix social engineering tactic initiated via fake CAPTCHA verification pages.”This campaign leverages deceptive CAPTCHA verification pages that trick users into executing a malicious PowerShell script, which ultimately deploys the infostealer, harvesting sensitive data such as First seen on thehackernews.com…
New Rust-Based InfoStealer Uses Fake CAPTCHA to Deliver EDDIESTEALER

May 30, 2025 10:55 AM

Tags: captcha, cyber, data, google, malicious, powershell, rust, social-engineering, windows

A newly discovered Rust-based infostealer, dubbed EDDIESTEALER, has been uncovered by Elastic Security Labs, spreading through a sophisticated social engineering tactic involving fake CAPTCHA verification pages. Mimicking legitimate CAPTCHA systems like Google’s reCAPTCHA, these malicious prompts deceive users into executing harmful PowerShell scripts, ultimately deploying the infostealer on Windows systems to harvest sensitive data such…
6 rising malware trends every security pro should know

May 29, 2025 8:55 AM

Tags: adobe, ai, antivirus, apple, attack, awareness, backdoor, business, captcha, cloud, corporate, cybercrime, data, defense, detection, encryption, endpoint, exploit, extortion, framework, group, hacking, incident response, infrastructure, intelligence, Internet, law, leak, macOS, malicious, malware, network, password, phishing, powershell, programming, pypi, ransom, ransomware, service, social-engineering, software, supply-chain, tactics, theft, threat, tool, update, vulnerability, worm

Malicious packages targeting developer environments: Threat actors are systematically compromising the software supply chain by embedding malicious code within legitimate development tools, libraries, and frameworks that organizations use to build applications.”These supply chain attacks exploit the trust between developers and package repositories,” Immersive’s McCarthy tells CSO. “Malicious packages often mimic legitimate ones while running harmful…
Vidar and StealC Malware Delivered Through Viral TikTok Videos by Hackers

May 22, 2025 6:55 PM

Tags: attack, captcha, cyber, cybercrime, exploit, hacker, malware, social-engineering, tactics

A sophisticated social engineering campaign that leverages the viral power of TikTok to distribute dangerous information-stealing malware, specifically Vidar and StealC. This alarming trend marks a shift in cybercriminal tactics, moving away from traditional methods like fake CAPTCHA pages to exploiting the vast user base and algorithmic reach of social media platforms. Unlike previous attacks…
What a Binance CAPTCHA solver tells us about today’s bot threats

May 20, 2025 4:54 PM

Tags: captcha, crypto, open-source, threat

In this post, we analyze an open-source CAPTCHA solver designed to bypass a custom challenge deployed on Binance, one of the most popular crypto platforms. While the solver is publicly available, we’ve intentionally chosen not to link to the original repository. The code is minimally documented and was First seen on securityboulevard.com Jump to article:…
Focused Phishing: Attack Targets Victims With Trusted Sites and Live Validation

May 14, 2025 5:39 PM

Tags: attack, captcha, email, login, phishing, tactics, zero-day

New phishing tactics are abusing trusted domains, real CAPTCHAs, and server-side email validation to selectively target victims with customized fake login pages. Keep Aware’s latest research breaks down the full attack chain and how these zero-day phish operate. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/focused-phishing-attack-targets-victims-with-trusted-sites-and-live-validation/
iClicker Website Hacked with Fake CAPTCHA in ClickFix Attack

May 13, 2025 5:38 PM

Tags: attack, captcha

Popular student engagement platform iClicker’s website was compromised with a ClickFix attack. A fake >>I’m not a robot