Cybersecurity officials have warned of a deceptive malware campaign that abuses fake CAPTCHA pages to trick users into launching malicious code through the Windows Run dialog, leading to the covert installation of infostealers.
According to findings released by the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) on March 20, the activity targeted government employees through phishing emails containing links to malicious or compromised websites. Once a recipient clicked the link, they were taken to a page posing as a routine security verification check. Instead of presenting a legitimate challenge, however, the page was designed to manipulate the user into executing malware.
How the Fake Verification Worked
The campaign relied on a highly deceptive workflow. Victims were sent to a fraudulent CAPTCHA page that automatically copied a command to the clipboard. The page then instructed them to open the Windows Run box and paste the copied content as part of an apparent verification step. The final visible text looked harmless and resembled normal CAPTCHA language, such as a line claiming the user was “not a robot” alongside a verification ID.
Behind the scenes, the pasted string actually triggered mshta.exe, a legitimate Windows utility that can be abused to retrieve and execute remote content. By hiding the malicious action inside what appeared to be a standard verification process, the attackers reduced suspicion and increased the odds that users would complete the action themselves.
NJCCIC said the outcome of the infection chain was the installation of SectopRAT, an infostealer designed to collect sensitive data from compromised systems. Because the attack leveraged a trusted Windows binary rather than an obviously malicious executable, the deployment could occur with limited visibility to the user.
Compromised Sites and Broader Infrastructure Abuse
The investigation found that the campaign was linked to compromised websites built with commonly used technologies, including the WordPress content management system and JavaScript libraries. That detail is significant because it shows the threat does not depend on obscure infrastructure. Instead, attackers are exploiting the familiarity and ubiquity of mainstream web technologies to blend malicious pages into otherwise ordinary browsing experiences.
Authorities also identified a supply chain angle in the broader activity. Some auto dealership websites were reportedly affected through a compromised video service, exposing visitors to the risk of downloading the same infostealer. This expands the threat beyond direct phishing emails and highlights how third-party services can become a malware delivery channel when upstream providers are compromised.
Not Limited to SectopRAT
Researchers said similar fake CAPTCHA campaigns have also been used to distribute other malware families, including Lumma and Vidar infostealers, as well as stealthier rootkits. That suggests the technique itself has become a reusable social engineering template rather than a one-off tactic tied to a single malware operator.
The model is effective because it flips a common security expectation on its head. CAPTCHA prompts are familiar to most users and are usually associated with proving human identity, not triggering a system-level action. By embedding malicious execution instructions inside a process people already recognize, attackers gain a psychological advantage that traditional phishing pages may not have.
Why the Attack Is Especially Dangerous
The social engineering element is central to the campaign’s success. Users are not simply downloading a suspicious attachment or clicking an obviously dangerous file. Instead, they are told to perform a sequence of steps that appears procedural and security-related. The use of clipboard manipulation further obscures the real intent by reducing the need for victims to inspect the command they are executing.
Abusing legitimate tools such as mshta.exe also fits into a broader pattern of “living off the land” techniques, in which attackers rely on trusted system components to evade detection and make malicious behavior appear normal. In practical terms, that can make incident response more difficult, especially when the initial execution path is triggered manually by the user and cloaked in a plausible verification narrative.
Official Guidance for Users and Administrators
NJCCIC emphasized that legitimate CAPTCHA systems do not require users to copy and paste commands into the Windows Run dialog. That warning is one of the clearest takeaways from the case. Any page that instructs a user to press Win+R, open Run, paste text, or execute a command as part of a verification process should be treated as malicious.
For administrators, officials recommended updating software promptly, hardening CMS credentials, and reviewing the security posture of web environments that rely on common platforms and third-party components. They also advised reporting suspected incidents to the FBI’s Internet Crime Complaint Center and NJCCIC.
For end users, the best defense is skepticism toward unusual verification workflows. A real CAPTCHA may ask users to identify images, solve a visual challenge, or complete a checkbox step, but it will not ask them to run commands on their own machine. If a webpage claims that command execution is required to prove you are human, the safest response is to close the page immediately and avoid further interaction.
A Sign of Evolving Social Engineering
The campaign underscores how malware operators continue to refine social engineering by hijacking trusted user experiences. Instead of relying solely on fake invoices or malicious downloads, they are increasingly embedding payload delivery into interactions that seem routine, administrative, or security-focused.
That evolution matters because it lowers the barrier to compromise. A user who would never open a suspicious attachment might still comply with a fake CAPTCHA prompt if the page appears polished and the request sounds technical but routine. As attackers continue to borrow the language and visual cues of legitimate online security checks, awareness training and clear user guidance become even more important.
In this case, the simplest rule may also be the most effective: no legitimate CAPTCHA should ever require command execution on your device. Treat any such prompt as a red flag for malware.