A sophisticated malware campaign is targeting Windows users through deceptive CAPTCHA verification prompts that trick victims into executing malicious PowerShell scripts. Security experts recommend implementing robust security awareness training and advanced endpoint protection solutions capable of detecting multi-stage PowerShell attacks to protect against these increasingly sophisticated threats. This resurgence of fake CAPTCHA attacks, identified in early February 2025, represents a growing threat as attackers continue to employ social engineering tactics to bypass security measures and compromise systems. Moreover, the retrieved PowerShell scripts are intentionally large in file size, an apparent attempt to evade sandbox or emulation-based detection mechanisms that impose execution limits. Further investigation confirmed that beyond data exfiltration, the malware downloads additional components including a Telegram bot-based HijackLoader and a Golang-based backdoor disguised as legitimate software like ‘TiVo Desktop’. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. However, instead of simply proving they are human, users are prompted to execute a PowerShell command that initiates a multi-stage infection process. When users execute the deceptive command, it launches a series of complex, encrypted PowerShell scripts. The attack begins when users encounter what appears to be a standard CAPTCHA verification on compromised or malicious websites. The HTA file then triggers additional PowerShell scripts through a sophisticated multi-stage decryption process. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. This command is disguised as part of the verification process, making it seem legitimate to unsuspecting users. The initial command appears as: powershell -NoProfile -Command "mshta # 'I am not a robot - rëCAPTCHA Verification ID: 2188". Researchers discovered that the attack uses XOR encryption with the key “AMSI_RESULT_NOT_DETECTED” to bypass security tools.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 13 Mar 2025 08:25:14 +0000