Cyberattackers Embrace CAPTCHAs to Hide Phishing, Malware

guest · Aug 13, 2021

Cyberattackers Embrace CAPTCHAs to Hide Phishing, Malware
August 13, 2021
https://threatpost.com/cyberattackers-captchas-phishing-malware/168684/

Cyberattackers are using Google’s reCAPTCHA (aka the “I am not a robot” function) and fake CAPTCHA-like services to obscure various phishing and other campaigns, according to researchers. There are signs however that those evasion efforts may be losing their efficacy.

CAPTCHAs are familiar to most internet users as the challenges that are used to confirm that they’re human. The Turing test-ish puzzles usually involve clicking all photos in a grid that contain a certain object, or typing in a word presented as blurred or distorted text.
The idea is to weed out bots on eCommerce and online account sites – and they serve the same purpose for crooks.
Click to expand...

“Hiding phishing content behind CAPTCHAs prevents security crawlers from detecting malicious content and adds a legitimate look to phishing login pages,” according to a Friday writeup from Palo Alto Networks’ Unit 42.
Beyond Phishing: New Categories of Malicious URLs
Besides the endless litany of phishing campaigns, scam campaigns and malicious gateways using CAPTCHA evasion are on the rise, according to Unit 42.

“Survey and lottery scams are some of the most common grayware pages,” according to the posting. “In exchange for a fake payment or chance at winning the lottery, the user is lured into disclosing sensitive information, including address, date of birth, banking information, annual income, etc.”
Another growing category is malware delivery pages abusing legitimate CAPTCHA services.
Click to expand...

Palo Alto Networks - Unit42: Discovering CAPTCHA Protected Phishing Campaigns

Unit 42 researchers have been observing various malicious campaigns abusing either legitimate challenge and response services (such as Google’s reCAPTCHA) or deploying customized fake CAPTCHA-like validation. Recent security blogs on phishing campaigns and cybercriminals using reCAPTCHA and research papers like PhishTime and CrawlPhish show an increasing trend of CAPTCHA-protected phishing pages. Hiding phishing content behind CAPTCHAs prevents security crawlers from detecting malicious content and adds a legitimate look to phishing login pages.

In this blog, we show techniques to detect malicious content with security crawlers even in the presence of CAPTCHA evasion. In some cases, these techniques can even track and detect such campaigns. We see many malicious campaigns reuse CAPTCHA service keys, either to simplify their malware infrastructure or to avoid being blocked by the legitimate reCAPTCHA provider for creating too many CAPTCHA accounts and keys.
Click to expand...

guest · Aug 17, 2021

Malware campaign uses clever 'captcha' to bypass browser warning
August 17, 2021
https://www.bleepingcomputer.com/ne...ses-clever-captcha-to-bypass-browser-warning/

A malware campaign uses a clever captcha prompt to trick users into bypassing browsers warnings to download the Ursnif (aka Gozi) banking trojan.

Yesterday, security researcher MalwareHunterTeam shared a suspicious URL with BleepingComputer that downloads a file when attempting to watch an embedded YouTube video about a New Jersey women's prison.
Click to expand...

When you click on the play button, the browser will download a file named console-play.exe [VirusTotal], and the site will display a fake reCaptcha image on the screen.

As this file is an executable, Google Chrome automatically warns that the file may be malicious and prompts whether you wish to 'Keep' or 'Discard' the file.
To bypass this warning, the threat actors are displaying a fake reCaptcha image that prompts the user to press the B, S, Tab, A, F, and the Enter buttons on their keyboard, as shown below.

As you can see, this fake captcha prompt is a clever way to trick a user into downloading a malicious file that the browser is warning could be malicious.
Click to expand...

Site distributes Ursnif information-stealing trojan
If a user runs the executable, it will create a folder under %AppData%\Bouncy for .NET Helper and install numerous files. All of these files are a decoy, other than the BouncyDotNet.exe executable, which is launched.
These PowerShell commands will compile a .NET application using the built-in CSC.exe compiler that launches a DLL for the Ursnif banking trojan.

Once running, Ursnif will steal account credentials, download further malware to the computer, and execute commands issued remotely by the threat actors.
Click to expand...

Log in or Sign up

Cyberattackers Embrace CAPTCHAs to Hide Phishing, Malware

guest Guest

guest Guest

Log in or Sign up

Cyberattackers Embrace CAPTCHAs to Hide Phishing, Malware

guest Guest

guest Guest

Useful Searches