{"id":22152,"date":"2025-08-05T09:06:59","date_gmt":"2025-08-05T02:06:59","guid":{"rendered":"https:\/\/fpt-is.com\/en\/?post_type=goc_nhin_so&p=22152"},"modified":"2026-01-20T10:23:37","modified_gmt":"2026-01-20T03:23:37","slug":"cybercriminals-exploit-im-not-a-robot-captchas","status":"publish","type":"goc_nhin_so","link":"https:\/\/fpt-is.com\/en\/insights\/cybercriminals-exploit-im-not-a-robot-captchas\/","title":{"rendered":"Cybercriminals Exploit “I’m Not a Robot” Captchas for Malware"},"content":{"rendered":"
\n

A new sophisticated malware attack exploits users through fake browser verification windows designed to resemble legitimate CAPTCHA systems.<\/p>\n

How it Works<\/strong><\/h1>\n

The attack begins when users encounter a seemingly authentic browser security check page, featuring the familiar “I\u2019m not a Robot” interface similar to Google\u2019s reCAPTCHA system.<\/p>\n

However, instead of clicking on squares or selecting images as usual, this fake verification interface instructs users to perform a series of keyboard shortcuts to “complete the browser check.”<\/p>\n

The malicious interface presents three seemingly harmless steps:<\/p>\n

    \n
  1. Press Windows + R to open the Run dialog box,<\/li>\n
  2. Press Ctrl + V to paste content from the clipboard,<\/li>\n
  3. Press Enter to execute the command.<\/li>\n<\/ol>\n<\/div>\n

    \"Unnamed<\/a><\/p>\n

    Figure 1. Process of performing malicious behavior<\/em><\/p>\n

    \n

    Attackers have meticulously designed the interface to look authentic, using visual elements and language similar to legitimate security checks.<\/p>\n

    Technical Analysis<\/strong><\/h1>\n

    Technical analysis reveals that the core of the attack lies in clipboard manipulation and the use of sophisticated PowerShell obfuscation techniques.<\/p>\n

    When users visit the malicious website, a JavaScript code automatically copies an obfuscated PowerShell command string into the clipboard without the user’s knowledge.<\/p>\n

    This PowerShell payload employs multiple layers of obfuscation, including base64 encoding, string concatenation, and variable substitution to evade static analysis tools and signature-based AV detection.<\/p>\n

    The obfuscated PowerShell command typically contains instructions to download and execute additional malicious payloads from a remote server. Notably, security analysts have observed many fileless attack variants\u2014malware that operates only in memory (RAM) without writing files to the hard drive\u2014making detection even more challenging.<\/p>\n

    Additionally, the PowerShell execution uses legitimate Windows processes and services, making the malware appear as normal system activities while maintaining persistence through registry modifications or scheduled tasks.<\/p>\n

    Recommendations<\/strong><\/h1>\n

    FPT Threat Intelligence<\/strong>\u00a0recommends several measures for organizations and individuals to prevent this dangerous attack campaign:<\/p>\n