The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) disclosed on March 20 an alarming malware campaign targeting state government employees through deceptive CAPTCHA challenges. Attackers sent emails containing links to malicious or compromised websites that posed as legitimate security verification pages. According to NJCCIC, “the emails contain links directing targets to malicious or compromised websites and prompting deceptive CAPTCHA verification challenges.”
Deceptive Mechanism: Copy-Paste Command in Windows Run
The attack method is particularly sophisticated. Victims who click the link are directed to a fake CAPTCHA page that automatically copies a command to their clipboard. The website then instructs users to open the Windows Run dialog (Win+R) and paste the command as part of a supposed verification step. Although the pasted text ends with a standard message — “I am not a robot – reCAPTCHA Verification ID: ####” — executing the command actually launches mshta.exe, a legitimate Windows binary used to fetch and execute malware disguised in common file types. This silently installs the SectopRAT infostealer, which can exfiltrate credentials, sensitive documents, and other data.
Attack Chain: Exploiting Common Technologies and Supply Chains
NJCCIC traced the campaign to compromised websites using widely adopted tools such as WordPress Content Management System (CMS) and JavaScript libraries. The investigation also uncovered a supply chain component: attackers compromised a video service used by auto dealership websites, turning visitors into potential victims of the same infostealer. Cybersecurity researchers documented similar fake CAPTCHA campaigns distributing Lumma and Vidar infostealers as well as stealthy rootkits. The agency stressed that legitimate CAPTCHA verification never requires users to copy and paste commands into the Windows Run dialog.
Security Recommendations and Response
Officials advised system administrators to update all software and plugins promptly, strengthen CMS credentials, and conduct security awareness training to warn employees about such social engineering tactics. Users should treat any “verification” that asks them to manually copy-paste commands into Run as a red flag. Incidents should be reported to the FBI’s Internet Crime Complaint Center (IC3) and NJCCIC.