A sophisticated social engineering technique has recently emerged in the cybersecurity landscape, rapidly gaining traction among threat actors seeking to distribute trojans, ransomware, and particularly Quakbot malware.

This technique, known as ClickFix Captcha, exploits users’ trust in familiar web elements to bypass traditional security measures and deliver malicious payloads to Windows systems.

The attack begins when users visit compromised or malicious websites that redirect them to a seemingly legitimate captcha verification page at domains such as cfcaptcha[.]com.

Unlike traditional captchas that require users to identify objects or type text, ClickFix captchas instruct users to perform specific actions on their computers, such as pressing Windows key + R, claiming this will verify they aren’t bots.

Dark Atlas researchers detected that when users follow these instructions, they unwittingly execute malicious commands that have been preloaded into their clipboard.

The researchers noted the commands typically invoke PowerShell to download and execute additional malicious code while displaying deceptive “Verification complete” messages to maintain the illusion of legitimacy.

The infection chain is particularly insidious because it leverages common Windows functionality rather than exploiting technical vulnerabilities.

When users press Windows key + R after interacting with the captcha, they open the Run dialog, and the malicious command in their clipboard is automatically inserted.

One keystroke later, the system is compromised.

Advanced Infection Mechanism

The technical sophistication of this attack lies in its multi-stage execution process.

Upon execution, the clipboard-injected command typically contains obfuscated PowerShell code that downloads a remote file.

PowerShell command that executes the retrieved string as a PowerShell command (Source – Dark Atlas)

This initial payload displays a fake verification message while silently downloading additional components from attacker-controlled domains like duolingos[.]com.

Attacker-controlled domain (Source – Dark Atlas)

Analysis of the malicious code revealed XOR encryption techniques designed to evade detection. The decrypted payload contains instructions to download and extract ZIP files to the user’s AppData directory.

One captured example showed commands to retrieve “flswunwa.zip” and extract its contents, which would then establish persistence and potentially exfiltrate sensitive data.

What makes ClickFix particularly dangerous is the attackers’ implementation of rewrite rules and PHP-based proxies on compromised servers, allowing them to generate unlimited unique URLs for malware distribution while concealing the actual origin of the malicious content.

The post ClickFix Captcha – A Creative Technique That Allow Attackers Deliver Malware and Ransomware on Windows appeared first on Cyber Security News.