Fake Cloudflare CAPTCHA ClickFix lures hide malware in PNG images
Original title: Hackers Use Fake Cloudflare CAPTCHA Checks to Deploy Malware Hidden Inside PNG Images
Huntress says pasted PowerShell rebuilt full executables from PNG pixel data, then added persistence and lateral movement.
Threat actors use fake Cloudflare verification pages, reached through Bing ads, SEO poisoning, or compromised sites, to make victims paste PowerShell. Huntress describes a case that unpacked a signed Microsoft binary, a rogue DLL, and a batch file, then reconstructed executables hidden in PNGs. Later cases included Active Directory reconnaissance, WinRM access to a domain controller, and loaders such as Matanbuchus and EtherRAT.
Unconfirmed: Huntress and named researchers describe the cases; no threat group is attributed.
- One chain staged a 17,635-byte file in the browser cache and ran it as a batch file.
- A September case sideloaded CertEnroll.dll and tunneled SSH to 23.227.199.41.
- A February intrusion installed Matanbuchus 3.0 and AstarionRAT, then used PsExec.
- A May case spread Potemkin, RMMProject, and EtherRAT to 11 hosts.
- Another lure abused ChatGPT Custom GPTs and was tied to at least 40 incidents.
Impact: Persistence, reconnaissance, credential theft, and lateral movement
- 1.Alert when browsers spawn cmd or PowerShell.
- 2.Watch for batch files copied from browser cache, unexpected Run keys, scheduled tasks, and outbound SSH.
- 3.Restrict the Windows Run dialog for users who do not need it.
- ATT&CK
- T1059.001 PowerShellT1027.003 SteganographyT1574.002 DLL Side-LoadingT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ghost.io | Indicators of Compromise Item Description https://vvestalw.ghost[.]io/ Typosquatted redirector presented after the Bing search. |
| domain | moziw.com | quatted redirector presented after the Bing search. https://moziw[.]com/vvestalw/ Additional redirector in the delivery chain. ht |
| domain | westlaw-signon.com | stalw/ Additional redirector in the delivery chain. https://westlaw-signon[.]com/ ClickFix landing page that displayed the fake verificati |
| ipv4 | 167.148.201.104 | oring tool. It persisted through a Run key and connected to 167.148.201[.]104 on port 3861. Huntress has tracked many related lures. On |
From the original article
3 min read at gbhackers.com
Threat actors are pushing ClickFix well beyond its usual role as a delivery mechanism for scripts and infostealers. ClickFix lures typically begin with a counterfeit Cloudflare “Verify that you are human” turnstile. Victims arrive through Bing malvertising, SEO poisoning or compromised websites.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.