Interesting Article on Captchas and Malware

I have always been leery and annoyed by Captchas. As the article states most savvy users would not complete the verification steps but the article does highlight the lengths hackers will employ. (excerpts)


If you follow the steps, the website copies a text string to your Windows clipboard. Normally, you'd have to grant your permission for such an action, but you already did so by checking a checkbox on the first screen of the CAPTCHA prompt.

As seen in the Windows Run text field, the string says simply: "I'm not a robot -- reCAPTCHA Verification ID: 8253." But behind the scenes is another string, one that runs a Windows command called Mshta.exe. Normally, this file is a legitimate and safe command used to execute code, but hackers and scammers can easily exploit it to download and install malware.

CAPTCHAs are typically a good thing; however, anything for good is often a method to be exploited or altered for a bad outcome. As innovated as the good guys are the bad guys are equally innovative and have a surplus of something the good guys don't: time. In my career I've seen some pretty crazy and innovative TTP (tactics, techniques and procedures) threat actors have used to reach their goals.

I've done a number of POC's for some interesting things :)

I created a rudimentary file transfer protocol that entirely used just ping commands, or stored "malware" (fake) as event logs in the windows event view.

That evil clipboard CAPTCHA has been around for at least six months:

This CAPTCHA Test Can Trick Windows Users Into Installing Malware [PC Mag - September 13, 2024]

Now and then I indeed have to solve those little puzzles, where you have to click images that do correspond (or not) as captcha. Mostly at download sites, but even Google would ask me if I am a human, when I do a repeated search for something. So it'is very good to know, that a trick exists that tries to install malware.

I did not yet see any fake captchas like this, probably because I dont download illegal stuff, but you never know.

So @csun : thanks for the information!