A recent wave of sophisticated cyberattacks has targeted users with deceptive “Prove You Are Human” verification schemes, successfully deploying the NetSupport remote access trojan (RAT) through a series of technically complex, multi-stage payloads.
Security analysts have uncovered a campaign that leverages spoofed Gitcodes paste services and fraudulent Docusign CAPTCHA verification pages, compelling users to unwittingly execute malicious PowerShell scripts on their Windows platforms.
Multi-Stage Attacks Leverage Fake Verification Pages
The attack vector capitalizes on user trust in familiar verification interfaces. Victims land on seemingly legitimate web pages branded as Gitcodes or Docusign that emulate common CAPTCHA checks.
However, rather than solving a standard CAPTCHA, users are duped into copying a PowerShell script into their Windows Run prompt.
This initial script acts as a downloader, reaching out to attacker-controlled infrastructure to fetch subsequent payloads, each designed to evade detection and establish persistent access.
Technical analysis reveals that these scripts are hosted on domains such as gitcodes[.]org, which presents itself as a reputable code-sharing service.
The hosted scripts use string concatenation and user agent spoofing to obfuscate traffic, initially reaching command and control domains like tradingviewtool[.]com.
The attack unfolds in distinct stages: the first script downloads another downloader, which in turn retrieves additional executables including legitimate tools such as 7zip.
These tools are leveraged to unpack and launch the final RAT executable (client32.exe), with persistence ensured by modifying the Windows Registry Run key.
The malware is disguised as “My Support” to further blend into the operating system environment.
NetSupport RAT Delivered
Further investigation into the malicious infrastructure uncovered similar tactics on Docusign-themed domains.
Here, the attackers employ an additional social engineering layer: a page disguised as a Cloudflare “Checking your browser” CAPTCHA prompts the user to perform clipboard actions, effectively poisoning the user’s clipboard with a pre-encoded PowerShell command.
This command, once executed, downloads persistence mechanisms, creates shortcuts in the Windows Startup folder, and initiates callbacks to attacker servers via AJAX polling a primitive command-and-control protocol awaiting user action.
Obfuscation techniques such as ROT13 encoding are used to evade signature-based detection.
The staged payload delivery breaks the infection chain into discrete parts, increasing the likelihood that at least one component bypasses endpoint security measures.
In cases involving Docusign clones, the attack downloads zipped executables (e.g., jp2launcher.exe), which then initiate additional payload retrievals each culminating in the installation of NetSupport RAT.
According to the Report, Network callbacks have been observed to domains such as mhousecreative[.]com and directly to IP-based endpoints.
Broader scans of the infrastructure reveal identical clipboard poisoning and downloader script logic employed across other spoofed brands, including Okta and popular media streaming platforms, with payloads even hosted on Discord and GitHub.
This methodology hints at an adaptive malware ecosystem with disposable early-stage delivery domains and more resilient, longer-lived infrastructure for later payloads.
Attribution remains challenging, but indicators point to known threat actor clusters previously associated with the SocGholish malware family and other groups exploiting legitimate remote administration tools for illicit access.
Security experts urge organizations and end users to exercise extreme caution when prompted to execute scripts from web-based prompts, especially during supposed verification checks.
Legitimate CAPTCHA systems never require the execution of downloaded scripts or commands.
Defensive recommendations include rigorous URL and domain validation, skepticism toward unusual verification workflows, and user education to mitigate self-infection risks.
This campaign underscores the relentless evolution of social engineering tactics and the increasing technical sophistication of multi-stage malware delivery.
It also highlights the urgent need for proactive defenses and robust user awareness in the face of ever-more devious threat actors exploiting everyday digital interactions.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
