The National Computer Emergency Response Team (National CERT) has released a cybersecurity advisory warning organizations of a new malware campaign leveraging fake CAPTCHA verification pages to deceive users. Dubbed “Fake CAPTCHA Pages Leveraging PowerShell for Malware Delivery,” the advisory highlights the sophisticated social engineering tactics cybercriminals are using to compromise systems.
The campaign, which has already targeted users in the region, specifically focuses on individuals seeking free online content. Threat actors are redirecting victims to malicious websites disguised as legitimate media platforms, where users are prompted to complete a CAPTCHA verification. Once the fraudulent CAPTCHA is interacted with, a malicious PowerShell script is copied to the user’s clipboard. The user is then tricked into executing the script, which downloads additional malware onto their system.
The malware, capable of stealing information and scanning networks, enables attackers to further exploit compromised environments. The advisory underscores how these fake CAPTCHA pages imitate authentic verification processes, using PowerShell commands to bypass traditional security defenses and download malicious files from an attacker-controlled server.
Key indicators of compromise (IOCs), including malicious URLs and file hashes, have been identified, and organizations are urged to monitor and block these immediately. The advisory also emphasizes that this campaign facilitates lateral movement within networks through malware such as infostealers and network scanners, heightening the risk of broader exploitation.
To mitigate these threats, National CERT recommends several immediate measures:
- Educating users on the dangers of social engineering, particularly involving unknown commands.
- Monitoring network traffic for suspicious connections.
- Enabling PowerShell logging to detect unauthorized activity.
- Implementing multi-factor authentication (MFA) and restricting privileged access.
- Deploying endpoint detection and response (EDR) solutions to enhance defenses.
- Blocking identified malicious domains and URLs to prevent further compromise.
With this emerging threat, organizations are advised to remain vigilant, bolster endpoint protection, and adopt proactive monitoring to safeguard their networks against evolving malware attacks.
Source: NCERT
