Hackers have devised a new tactic to infiltrate systems by using fake CAPTCHA pages to distribute malware that disables security measures. This method involves compromised WordPress sites and prompts users to execute seemingly benign commands on their Windows systems, ultimately leading to a malware infection.
How the Attack Unfolds
The operation begins when users visit a compromised WordPress site. They are presented with a fake verification page that mimics a Google reCAPTCHA, Cloudflare Turnstile, or a Windows error message. Instead of exploiting software vulnerabilities, the attackers rely on social engineering to trick users into executing a PowerShell command that initiates the malware download.
Once the command is run, it triggers the Cruciferra malware loader, which in turn deploys the Remus information stealer. This process is facilitated by ErrTraffic, a service that creates ClickFix lures resembling legitimate CAPTCHA pages.
Impact and Techniques
This malware campaign is particularly effective due to its ability to disable security software before deploying more harmful payloads. Cruciferra uses a signed but vulnerable driver to terminate antivirus and endpoint detection processes, significantly reducing the chances of detection and intervention.
By leveraging this vulnerability, attackers can blind systems to further malicious activities, such as data theft or additional malware deployment. The use of legitimate drivers in this manner is part of a broader strategy known as the bring-your-own-vulnerable-driver technique.
Protecting Against the Threat
Organizations should be vigilant in blocking the vulnerable driver by its hash and ensure that Microsoft’s protections against vulnerable drivers remain active. Security teams should be on the lookout for unusual system behavior, such as unexpected driver services or suspicious browser activities requiring keyboard shortcuts.
User education is crucial in preventing such attacks. Employees should be informed that legitimate CAPTCHA checks will never request the execution of commands in Windows tools. Detecting the presence of the loader, driver, or related network infrastructure should prompt an immediate investigation to prevent further compromise.
As attackers continue to refine their techniques, maintaining robust cybersecurity measures and awareness is essential to safeguarding systems against such deceptive campaigns.
