#Fakecaptcha

Rachel E. Tell (is querying)

@racheletell.bsky.social

4 months ago

A FAKE reCAPTCHA with the header "Complete these Verification Steps". DO NOT follow the website's steps. They are listed as "To better prove you are not a robot, please: 1. Press & hold the Windows Key + R, 2. In the verification window, press Ctrl+V, 3. Press Enter on your keyboard to finish. You will observe and agree: I am not a robot - reCAPTCHA Verification ID" And a Verify button. Do not actually perform any of those steps.

Hey friends, found out about this fake Captcha recently. If you happen to stumble on a website where you see this, do NOT follow the steps. Get out of there and run a malware scan instead.

#scamalert #fakecaptcha

Proactive.IT Appointments

@proactiveitrec.bsky.social

5 months ago

Attackers Abuse AI Tools to Generate Fake CAPTCHAs in Phishing Attacks Trend Micro said the use of AI platforms to create and host fake CAPTCHA pages helps attackers develop more sophisticated phishing campaigns at scale and speed

'Cybercriminals are abusing AI platforms to create and host fake CAPTCHA pages to enhance phishing campaigns'

#AI #Phishing #FakeCAPTCHA

Sakaijjang

@sakaijjang.bsky.social

6 months ago

Fakecaptcha 를 이용한 ClickFix(클릭픽스) 공격-45(.)32(.)133(.)19(2025.9.2) 오늘은 Fakecaptcha 를 이용한 ClickFix(클릭픽스) 공격에 대해 알아보겠습니다. 클릭픽스 공격은 뭐~간단합니다.해당 악의적으로 만들어진 ClickFix(클릭픽스)로 이동을 합니다. 그리고 여기서 Verify you are human by completing the action below. 이라는 것을 보게 되고 여기서 사람인 것을 증명하기 위...

Fakecaptcha 를 이용한 ClickFix(클릭픽스) 공격-45(.)32(.)133(.)19(2025.9.2)
wezard4u.tistory.com/429587
#클릭픽스 #ClickFix #Fakecaptcha

CySecurity News

@cysecuritynews.bsky.social

6 months ago

Hackers Trick Users with Fake Captchas to Steal Data   Cybersecurity researchers have uncovered a new technique where attackers use fake Captcha tests to trick people into installing malware called Lumma Stealer. This malicious program is designed to quietly search infected computers for valuable information, such as login credentials, cryptocurrency wallet details, and two-factor authentication codes. The scheme first appeared on a Greek banking website, where users were shown what looked like a Captcha security test. Instead of a normal verification, the prompt instructed Windows users to copy a piece of text into their Run dialog box and press Enter. By doing so, victims unknowingly triggered the installation of Lumma Stealer without downloading a visible file. According to data shared by DNSFilter, a security company monitoring the incident, clients came across this fake Captcha 23 times in just three days. Alarmingly, around 17% of users who saw it followed the instructions, which led to attempts to infect their systems with malware. How Lumma Stealer Works Once inside a computer, Lumma Stealer immediately begins searching for anything that can be exploited for profit. This includes saved browser passwords, cookies, stored two-factor authentication tokens, cryptocurrency wallets, and even the data kept in password managers. Cybercriminals can use this stolen information to commit identity theft, break into financial accounts, or steal digital assets such as crypto funds. What makes this threat particularly concerning is that Lumma Stealer can be hidden on otherwise legitimate websites, meaning unsuspecting users may fall victim even without visiting suspicious or obviously harmful pages. Malware-as-a-Service Model Lumma Stealer is part of a growing cybercrime trend known as Malware-as-a-Service (MaaS). Under this model, professional malware developers create the malicious software, improve its ability to avoid detection, and maintain hosting services. They then rent access to the malware to other cybercriminals in exchange for subscription fees. This arrangement makes it easy for attackers with little technical expertise to launch damaging campaigns. Earlier this year, authorities attempted to disrupt Lumma Stealer operations. The U.S. Department of Justice seized several domains linked to the malware, while Microsoft removed thousands of related websites. However, security analysts report that Lumma Stealer quickly resurfaced, showing just how resilient and profitable such services can be. Part of Lumma Stealer’s popularity comes from its low cost. Subscriptions can be found on underground forums for only a few hundred dollars per month, yet the potential financial return for criminals is enormous. In recent analyses, experts estimated that hundreds of thousands of devices have been compromised, with losses reaching tens of millions of dollars. The importance of staying alert online cannot be emphasised enough. Unusual instructions, such as copying text into a computer’s Run command should raise suspicion immediately. Cybersecurity specialists advise users to verify unexpected prompts and ensure their systems are protected with updated security tools to reduce the risk of infection.

Hackers Trick Users with Fake Captchas to Steal Data #2FA #cryptocurrency #FakeCaptcha

The Daily Tech Feed

@thedailytechfeed.com

6 months ago

UNC5518 exploits legitimate websites by injecting fake CAPTCHAs to deploy malware. Stay vigilant and verify security prompts. #CyberSecurity #Malware #UNC5518 #FakeCAPTCHA #ClickFix Link: thedailytechfeed.com/unc5518-expl...

Paxion Cybersecurity

@paxioncyber.bsky.social

6 months ago

Group UNC5518 hacks real websites to inject fake CAPTCHAs that trick users into running malware.

➡️ One click = malicious PowerShell command
➡️ Payload = CORNFLAKE.V3 backdoor

🔒Stay sharp. Stay secure. Stay Paxion.
#CyberSecurity #Malware #ClickFix #Paxion #FakeCAPTCHA

@matricedigitale.bsky.social

7 months ago

Captchageddon evolve la minaccia ClickFix con fake captcha che attivano malware stealer via clipboard, eludendo download e antivirus.

#browser #Captchageddon #ClearFake #ClickFix #fakecaptcha #Guardio #malware #stealer
www.matricedigitale.it/2025/08/06/c...

Nichole (Nikki)

@nikkinova.bsky.social

7 months ago

Don't fall for it. Stay informed& aware
#Hackers #FakeCaptcha

Hackread.com

@hackread.bsky.social

8 months ago

New Mocha Manakin Malware Deploys NodeInitRAT via Clickfix Attack Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

🚨 New malware alert: Mocha Manakin uses #Clickfix (fakeCAPTCHA) to trick users into deploying a custom backdoor called NodeInitRAT. Red Canary warns it could lead to ransomware!

🔗 hackread.com/mocha-manaki...

#CyberSecurity #CyberAttack #fakeCAPTCHA #MochaManakin #NodeInitRAT

CySecurity News

@cysecuritynews.bsky.social

9 months ago

Fake Booking.com CAPTCHAs Are Tricking Travelers Into Installing Malware   Cybercriminals are exploiting vacationers in a deceptive phishing campaign that mimics the well-known online travel agency, Booking.com. According to cybersecurity researchers at Malwarebytes Labs, this scam uses bogus CAPTCHA prompts to trick users into giving hackers remote access to their devices, compromising both personal and financial information. The attack typically starts with links shared on social media platforms or gaming websites, sometimes even appearing as sponsored advertisements. These links redirect users to fraudulent sites impersonating Booking.com—a legitimate OTA (online travel agency) widely used for booking flights, hotels, car rentals, and travel packages. Once a user clicks on the deceptive link, a counterfeit CAPTCHA prompt appears, asking them to check a box. This step secretly copies a command to the user's clipboard. The next prompt instructs users to run a specific keystroke combination on their device—a red flag, as this is not part of any authentic CAPTCHA process. Behind the scenes, the copied text contains a PowerShell command. Executing it initiates the download of several files that install a Remote Access Tool (RAT) known as Backdoor.AsyncRAT. This software enables attackers to remotely monitor and take control of the victim's system. How to identify and protect yourself from the Booking.com RAT scam: Always verify URLs: Malwarebytes Labs highlights that these fake domains shift regularly and vary in how legitimate they appear. Some might resemble real Booking.com URLs, like (booking.)guestsalerts[.]com, while others are more obscure, such as kvhandelregis[.]com. The safest approach is to avoid clicking on social media links or ads and instead navigate directly to the website by typing the URL into your browser’s address bar. Avoid using search engines for travel bookings: Searching for travel deals on platforms like Google may expose you to “malvertising,” where scammers replicate trusted brands to lure users through top-ranking sponsored results. It’s better to book directly with hotels, airlines, or verified OTAs. Don’t trust CAPTCHA forms from unknown sources:"Be wary of following instructions, such as executing commands, from websites, CAPTCHA forms, or social media videos, which can easily trick you into installing malware." Disabling JavaScript in your browser can block clipboard-based exploits, though it may also interfere with the functionality of many legitimate websites. Cybersecurity experts continue to stress vigilance, especially during peak travel seasons when scammers often ramp up such campaigns.

Fake Booking.com CAPTCHAs Are Tricking Travelers Into Installing Malware #AsyncRATattack #Bookingcomscam #FakeCaptcha

Gi7w0rm

@gi7w0rm.bsky.social

9 months ago

New #Blogpost scheduled for release tomorrow 8 a.m. (UTC+2). Analyzing a new #FakeCaptcha framework I call #HuluCaptcha. Besides codeanalysis, I also analyze 2 new #wordpress #backdoors and server logs. Hope you ll enjoy 😊

piggo

@pigondrugs.bsky.social

9 months ago

~Trendmicro~
Fake CAPTCHAs trick users into running malicious commands, deploying infostealers & RATs like Lumma, AsyncRAT.
-
IOCs: 176. 65. 141. 165, 185. 7. 214. 108, bi. yuoie. shop
-
#FakeCaptcha #Malware #ThreatIntel

ReconBee

@reconbee.bsky.social

10 months ago

iClicker site hack targeted students with malware via fake CAPTCHA into the Windows clipboard when visitors clicked read more about iClicker site hack targeted students with malware via fake CAPTCHA

iClicker site hack targeted students with malware via fake CAPTCHA reconbee.com/iclicker-sit...

#iclickersite #iclicker #hack #malware #malwareattack #fakecaptcha #captcha

Kenneth Kinion

@kennethkinion.bsky.social

10 months ago

Finding Booking.com themed ClickFix domains using Validin | Validin Finding Booking.com themed ClickFix domains using Validin

From on a report on X, we walk through proactive detection of a #booking #fakecaptcha #clickfix campaign delivering #asyncrat

As always, full indicator list and detailed step-by-step repro included 🔥 ⤵️
www.validin.com/blog/finding...

Gi7w0rm

@gi7w0rm.bsky.social

11 months ago

The website of the "Deutsche Vereinigung für internationales Recht" (dvir[.]de) is currently compromised and spreading #Lumma #Stealer via #FakeCaptcha attack.

Compromised webfile is:
hxxp[://]www[.]dvir[.]de/wp-content/themes/Dummy/assets/js/main[.]min[.]js?ver=1[.]0

GeorgiaMSP

@georgiamsp.com

11 months ago

🚨 Cyber Alert: Fake CAPTCHA = Real Threat! 🚨

Cybercriminals are tricking you into installing malware! 😱

Stay safe! Learn to protect your device: www.georgiamsp.com/2025/04/14/c...

#CyberSecurity #PhishingAlert #Malware #Infosec #GeorgiaMSP #SocialEngineering #FakeCAPTCHA #SecurityTips

ReconBee

@reconbee.bsky.social

11 months ago

OBSCURE#BAT Malware Uses Fake CAPTCHA Pages to Deploy Rootkit r77 and Evade Detection campaign's primary target audience read more about OBSCURE#BAT Malware Uses Fake CAPTCHA Pages to Deploy Rootkit r77 and Evade Detection

OBSCURE#BAT Malware Uses Fake CAPTCHA Pages to Deploy Rootkit r77 and Evade Detection reconbee.com/obscurebat-m...

#OBSCUREBAT #malwareattack #malware #fakecaptcha #Rootkitr77 #captcha #cyberattacks

Roberto Martinez

@mtnez.bsky.social

1 year ago

🚨 Are you tired of seeing attackers using ClickFix and FakeCAPTCHA every single day? Are you wishing there was something else to look at? 🚨

‼️The wait is over! Please, allow me to introduce you to "Suspicious IP", the new technique used to distribute... LummaC2. ‼️
🙄

#ClickFix #FakeCAPTCHA #LummaC2

ReconBee

@reconbee.bsky.social

1 year ago

Fake CAPTCHA Campaign Spreads Lumma Stealer in Multi-Industry Attacks website they are taken to a fake CAPTCHA page read more about Fake CAPTCHA Campaign Spreads Lumma Stealer in Multi-Industry Attacks

Fake CAPTCHA Campaign Spreads Lumma Stealer in Multi-Industry Attacks reconbee.com/fake-captcha...

#fakecaptcha #CAPTCHA #lummastealer #cyberattacks #cyberattack #industry #CyberSecurityAwareness #cybersecuritynews