Fake CAPTCHA (ClickFix) Attack Chain Leads to Enterprise‑Wide Malware Infection in Organisations

A sophisticated cyberattack campaign using "ClickFix" social engineering has been identified, posing a significant threat to enterprise networks worldwide.

These campaigns, which deceive users into executing malicious code by simulating a technical error, have become increasingly prevalent. A recent incident involving a large Polish organization illustrated how a single user's error can compromise an entire corporate infrastructure.

The attack strategy is highly deceptive. Users visiting compromised websites encounter fake CAPTCHA or error verification prompts, often mimicking interfaces of familiar applications such as Google Chrome or Microsoft Word.

This prompt instructs users to "fix" the issue by copying a specific PowerShell script and executing it through the Windows Run dialog (Win+R).

By relying on the user to execute the code, the attackers bypass standard browser security protections and automated download filters.

Upon execution of the script, a dropper is downloaded, initiating the infection chain. Cert.pl analysts identified the malware and noted suspicious traffic originating from the compromised host.

The analysis revealed that the initial PowerShell command retrieves a malicious payload from a remote domain, establishing a foothold within the network.

The impact of this infection is substantial, often leading to enterprise-wide compromise. Attackers use the initial access to deploy secondary payloads, such as the Latrodectus and Supper malware families.

These tools enable data exfiltration, lateral movement , and potential ransomware deployment.

Infection Mechanism and Evasion Tactics

The malware employs advanced evasion techniques, primarily relying on DLL side-loading to conceal its presence.

In the analyzed incident, attackers placed a legitimate igfxSDK.exe executable alongside a malicious wtsapi32.dll file in the %APPDATA%\Intel directory.

When the legitimate application launches, it automatically loads the malicious library, allowing the code to execute within the context of a trusted process.

This technique effectively hides the malicious activity from many basic endpoint detection solutions . Additionally, the identified Latrodectus variant utilizes significant anti-analysis mechanisms.

It performs NTDLL unhooking to remove monitoring hooks placed by antivirus software, making it difficult for security tools to detect its activities. The malware also checks for sandbox environments and refuses to execute if launched by standard system tools like rundll32.exe.

Recommendations include blocking the execution of unverified scripts, monitoring for unusual PowerShell activity, and educating employees about the dangers of "fixing" browser errors via the Run dialog.

Network administrators should also block known Command and Control (C2) IP addresses associated with Supper and Latrodectus.

Based on reporting by Cyber Security News.