Fake CAPTCHA Runs Malware

The video exposes a deceptive phishing campaign using fake "verify you are human" capture pages to socially engineer victims into copying and pasting malicious PowerShell commands, leading to the execution of an LMA (Lumma) stealer. 0:00

Key Takeaways:
• A user was lured via a redirect chain from ads to a fake capture page (4.bcn.net) that instructed them to press Win + R, Ctrl + V, and Enter to "verify" they are human 1:33.
• The clipboard-paste action executed a base64-encoded PowerShell payload using mshta, which downloaded and ran a Lumma info-stealing malware 2:42.
• The malware injected into legitimate Windows binaries like bitlocker.exe and searchindexer.exe to evade detection 6:25.
• Forensic analysis of the Windows Registry’s Run MRU list can reveal the malicious command history and confirm user compromise 13:00.
• The attack is part of a broader campaign observed across multiple security teams (Unit 42, Proof Point, Huntress) with shared indicators and domains 10:08.

This attack highlights how simple, cutesy social engineering can bypass security awareness and lead to full compromise. 21:45

Sources:

• 0:00 Initial investigation into unexplained PowerShell-based malware with no clear initial access vector.
• 1:33 Discovery of the fake "verify you are human" page and its copy-paste social engineering mechanism.
• 2:42 Decoding of the base64 PowerShell payload that invokes mshta to deliver Lumma st