Fake CAPTCHA Attack Leverages Microsoft Application Virtualization (App-V) to Deploy Malware

A recent campaign has been identified that employs a sophisticated method to deliver information-stealing malware by using social engineering techniques alongside legitimate Windows components.

The attack initiates with a misleading CAPTCHA prompt, tricking users into manually executing commands via the Windows Run dialog, under the guise of a verification process. This method deviates from traditional PowerShell execution, which is typically monitored by security tools, by exploiting Microsoft's Application Virtualization framework.

The attack chain reflects a strategic shift in malware delivery, focusing on the meticulous orchestration of each stage to evade automated analysis and security monitoring. The infection progresses only when specific conditions are met, ensuring the malware executes as intended. This design reduces the chance of detection in sandbox environments and minimizes the triggering of security alerts.

Blackpoint analysts have observed that the campaign is carefully planned across multiple execution stages, each reinforcing the security measures of the previous stage. The attackers use signed Microsoft components, user behavior-triggered execution gates, third-party services, and in-memory stages to achieve reliability and stealth.

The infection chain starts when users encounter a fake CAPTCHA interface, which prompts them to execute a command via the Run dialog, under the pretext of human verification. The command executes through SyncAppvPublishingServer.vbs, a legitimate script associated with Microsoft's Application Virtualization framework, altering the process execution path and blending into legitimate system activity.

This approach targets enterprise systems by leveraging the fact that App-V is integrated into modern Enterprise and Education versions of Windows 10 and Windows 11. The initial command sets a temporary environment variable, acting as a marker to ensure user execution, which becomes critical for further progression of the attack.

The embedded PowerShell logic reconstructs functionality at runtime using aliases and wildcard resolution, avoiding obvious command strings. Execution progresses only when the expected marker is present, retrieving configuration data from a public Google Calendar file, allowing updates without redeploying earlier stages.

This campaign highlights the innovation in how attackers package and distribute malicious code while evading detection. By using multiple obfuscation layers and timing execution precisely, the attackers maintain operational control and extend the lifespan of their infrastructure. The attack's success relies on compromised user judgment and the exploitation of trusted Microsoft infrastructure, effectively bypassing both security systems and human operators.

Based on reporting by Cyber Security News.