You might visit a local business website, and suddenly a CAPTCHA pops up. At first glance, it seems normal, but then it instructs you to open Windows Run and paste a command. That should raise a major red flag for you.
Security experts have revealed that thousands of legitimate small-business websites have been hacked to distribute this malware scheme. Here’s what you should know, so you don’t get caught off guard while browsing familiar sites.
Over 5,400 websites compromised
This issue is far more widespread than just a few infected pages. Research from Netskope Threat Labs indicates that over 5,400 websites belonging to more than 2,200 organizations globally have been compromised in recent months.
The sites mostly belong to small businesses, including clinics, plumbing services, online retailers, and a variety of other enterprises.
Many of these hacked sites utilize WordPress or sometimes PrestaShop, though researchers are still uncertain about how they were initially breached.
This is significant because you could easily stumble upon a malicious prompt while visiting a legitimate business website.
According to Netskope, several hundred compromised sites might be active on any given day. They have observed over 300 sites linking to the malicious infrastructure every weekday.
How the fake CAPTCHA malware operates
The attack begins when malicious code is concealed within a compromised website. When you access the site, that code can trigger another script to load. Subsequently, the page may blur and present what appears to be a standard CAPTCHA.
Instead of just asking if you’re human, the page instructs you to open the Windows Run dialog and paste a specified command. This command is designed to download and execute malware from the attacker.
Remember this key warning: A legitimate CAPTCHA will never instruct you to open Windows Run or paste commands into your computer.
I should emphasize that we’ve seen similar fake CAPTCHA scams before. You might see a page that looks familiar, leading you to believe that the instructions are just standard security procedures. But that’s not the case; the criminal is trying to make you unwittingly help them launch an attack.
Why ClickFix can deceive careful users
This method is known as ClickFix, and its effectiveness relies more on psychology than complex hacking tricks.
You’re likely accustomed to CAPTCHAs. Sites frequently ask you to verify you’re human by clicking boxes or identifying images. So, when faced with a convincing verification screen on a legit site, your defenses may drop. The dangerous actions might then seem like just another step in the verification process.
Cybercriminals have used similar ClickFix tactics with fake Windows update prompts. The specific appearance may vary, but the warning remains consistent: webpages should not direct you to run commands.
Hackers exploiting blockchain technology
This campaign takes an unusual twist as attackers utilize the BNB Smart Chain test network to store instructions for the compromised websites.
You don’t need to be a cryptocurrency expert to see the appeal for criminals. Typically, malicious code resides on standard web servers. If investigators locate that server, the hosting provider can shut it down.
A blockchain functions differently. In this scenario, attackers keep their code within something called a smart contract, serving as a hub for the hacked sites to retrieve their next set of instructions.
Netskope reports that the attackers are using the BNB Smart Chain’s test version, a space for developers to experiment without using real cryptocurrencies.
This approach offers criminals a cost-effective infrastructure that’s also trickier to dismantle through conventional means. Additionally, they can modify what the smart contract provides, allowing compromised websites to receive new instructions without needing to alter every individual site.
The campaign is evolving
Netskope has discovered a recent variation of the attack that does away with the fake CAPTCHA. This version employs WebRTC technology, typically used for video calls and real-time communications.
Now, the attackers utilize it to establish an encrypted data connection with themselves and deliver further malicious code through the browser. Netskope notes that this new code can execute without being saved as a traditional file on the computer.
Ultimately, the technicalities matter less than this overarching point: criminals can adapt their approach while still leveraging the same network of compromised sites.
6 tips to protect yourself from fake CAPTCHA malware
Adopting simple habits can help you avoid surrendering control of your computer to an attacker.
1) Don’t paste commands from a website
If a website prompts you to open Windows Run, PowerShell, or Command Prompt, stop immediately. Don’t paste anything it provides; just close the page instead.
2) Be wary of strange CAPTCHA instructions
A typical CAPTCHA will ask you to click a checkbox or identify pictures. It shouldn’t require you to change settings or execute commands. If the instructions take you outside the browser, close the page.
3) Use reliable antivirus software
Solid antivirus protection can help detect harmful scripts and malware. Ensure that it’s up to date, and enable real-time protection. If you accidentally comply with suspicious requests, perform a full system scan.
4) Keep your Windows and browser up to date
Install security updates promptly. Update Windows through its Update feature, and do the same for your browser via its settings. Don’t trust a random webpage asking you to download an update.
5) Act fast if you executed the command
If you followed suspect CAPTCHA instructions, disconnect from the internet immediately. Run a complete antivirus scan and use a trusted device to change passwords for sensitive accounts accessed on that computer, starting with your primary email. Review active login sessions and set up multifactor authentication whenever possible.
6) Website owners should check their sites
If you run a small business, this campaign should concern you as well. Netskope advises checking the integrity of your content management system files. Researchers have found malicious code embedded in legitimate JavaScript files or tucked away in fake plugin directories. Ensure that WordPress, PrestaShop, and any plugins you use are updated. Remove plugins no longer in use. Remember, Netskope hasn’t identified how attackers initially breached these sites, so while these are good security measures, no specific vulnerability has been tied to these compromises.
Key takeaways
What strikes me about this attack is just how ordinary it can appear initially. You could easily be on a website for a business you trust, only to encounter a familiar CAPTCHA. That built-up trust is precisely what makes the subsequent instruction perilous. The blockchain technology facilitating this campaign complicates things for security teams trying to shut it down, while, on the user end, the solution remains quite straightforward. A legitimate site will never request that you open Windows Run or paste a command to verify you’re human. If you encounter such a prompt, close that page immediately. That single warning could be key in preventing malware installation.
Would you be able to recognize a fake CAPTCHA if it popped up on a site you regularly trust? Or would the familiarity of the site make you more inclined to follow along? Feel free to reach out to share your thoughts.
