Cybersecurity Alert: Fake CAPTCHA Attack Endangers Enterprises

A new wave of sophisticated cyberattacks threatens enterprise networks worldwide, utilizing the ‘ClickFix’ social engineering tactic. This campaign targets organizations through deceptive methods, causing widespread concern in the cybersecurity community.

These attacks have gained momentum, deceiving users into executing harmful code disguised as a solution to a fabricated technical issue. A recent incident in Poland underscores how a single user’s mistake can jeopardize an entire corporate system.

Deceptive Attack Vector

The method used in these attacks is notably misleading. Users visiting compromised sites are presented with a counterfeit CAPTCHA or error prompt, often resembling interfaces from popular software like Google Chrome or Microsoft Word. This prompt instructs users to manually run a PowerShell script via the Windows Run dialog, bypassing typical security measures.

Upon execution, the script downloads a dropper, initiating a chain of infection. Analysts from Cert.pl discovered suspicious activity from the affected host early in their investigation, revealing that the initial PowerShell command fetches a malicious payload from an external domain, embedding itself within the network.

Widespread Implications

The consequences of such an infection are severe, frequently resulting in extensive enterprise compromise. Attackers leverage this initial access to introduce additional malicious software, such as the Latrodectus and Supper malware families, which enable data theft, lateral movement, and potential ransomware attacks.

By redirecting traffic through the compromised machine, cybercriminals can clandestinely map the internal network, identifying crucial assets for encryption or theft.

Advanced Evasion Techniques

The malware involved employs sophisticated evasion tactics, primarily using DLL side-loading to conceal its activities. In the Polish incident, attackers placed a legitimate executable alongside a malicious DLL in the %APPDATA%Intel directory. This method allows the malicious code to run under the guise of a trusted process, evading basic detection solutions.

The Latrodectus variant also incorporates anti-analysis features, such as NTDLL unhooking, to disable antivirus monitoring. It checks for sandbox environments and avoids execution if detected, complicating defense efforts. Experts recommend prohibiting unverified script execution, monitoring for unusual PowerShell activity, and educating staff on the risks of troubleshooting browser errors through the Run dialog.

Network administrators are advised to block known Command and Control (C2) IP addresses linked to these malware families to mitigate risks.