Cybersecurity researchers at the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) have uncovered a highly deceptive malware campaign that exploits fake CAPTCHA verification pages to trick users into running malicious commands. The attack chain, first reported on March 20, targets government employees via phishing emails, but extends to wider internet users through compromised websites and supply chain vectors. By abusing the legitimate Windows executable mshta.exe, attackers silently deploy information-stealing malware, posing a severe threat to cryptocurrency holders and enterprise networks alike.
The Attack Mechanism: A Clipboard-Based Trojan Horse
The attack begins with a phishing email containing links to malicious or compromised websites. When the victim clicks the link, they are presented with a fraudulent CAPTCHA page designed to mimic legitimate reCAPTCHA challenges. However, behind the scenes, the page automatically copies a malicious command to the clipboard. The user is then instructed to press Windows Key + R to open the Run dialog box, paste the command, and execute it as part of a "verification step." The pasted text often ends with a reassuring message like "I am not a robot – reCAPTCHA Verification ID: ####" to lower suspicion.
What the victim does not realize is that the command launches mshta.exe, a legitimate Windows binary intended to process HTML Application (HTA) files. Mshta.exe fetches and executes a remote HTA payload, which in turn downloads the final malware — typically the SectopRAT remote access trojan. SectopRAT provides attackers with full control of the infected machine, enabling them to steal browser passwords, cryptocurrency wallet credentials, screenshots, keystrokes, and files. Because mshta.exe is a signed Microsoft component, many antivirus and endpoint detection solutions hesitate to flag its activity as suspicious.
Supply Chain Attacks and Malware Variants
NJCCIC’s investigation revealed that the campaign leveraged previously compromised websites, many running the WordPress content management system (CMS) with outdated plugins or vulnerable JavaScript libraries. These sites served as hosts for the fake CAPTCHA pages, allowing attackers to reach a broader audience without sending individual phishing emails.
More alarming is the discovery of a supply chain component targeting auto dealership websites through a compromised third-party video service. Visitors to these dealership sites — including potential car buyers and employees — were silently exposed to the same malware chain. This demonstrates how attackers can achieve mass infection by compromising a single upstream service.
In parallel, cybersecurity researchers have documented multiple variants of the fake CAPTCHA campaign deploying different malware families. Beyond SectopRAT, the attack has been observed dropping Lumma and Vidar infostealers, as well as stealthy rootkits. Lumma and Vidar are particularly dangerous for cryptocurrency users because they specifically target wallet files, browser-based crypto extensions, and two-factor authentication tokens. The rootkits provide persistent stealth access, making detection and removal extremely challenging.
Legitimate CAPTCHA systems never ask users to copy and paste commands into their operating system. NJCCIC warns that any website requesting such actions is almost certainly malicious.
Defense Recommendations for Users and Administrators
To protect against this evolving threat, NJCCIC and other cybersecurity bodies recommend the following measures:
- Update all software promptly: Ensure that CMS platforms, plugins, JavaScript libraries, and server software are patched against known vulnerabilities. Attackers frequently exploit outdated versions to host malicious pages.
- Strengthen credentials and access controls: Use strong, unique passwords for all admin accounts and enable multi-factor authentication (MFA) wherever possible. For web administrators, restrict write access to critical files.
- Deploy advanced email filtering: Configure email gateways to scan attachments and URLs for phishing indicators. Sandbox analysis can detect malicious CAPTCHA links before they reach users.
- Educate employees and users: Conduct regular security awareness training emphasizing that no legitimate CAPTCHA requires running commands in the Windows Run dialog. Simple user skepticism can break the attack chain.
- Monitor for anomalous mshta.exe executions: Security teams should flag instances of mshta.exe launching from unusual parent processes (e.g., browser, document reader) or connecting to external IP addresses.
If an infection is suspected, immediately disconnect the device from the network, perform a full antivirus and anti-rootkit scan, and change all passwords and cryptocurrency private keys from a clean machine. Report the incident to the FBI’s Internet Crime Complaint Center (IC3) and local cybersecurity authorities.
For cryptocurrency holders, the advice is clear: store long-term assets in hardware wallets, avoid using browser extensions for high-value funds, and maintain offline backups of seed phrases. The fake CAPTCHA campaign is just one of many social engineering schemes targeting the crypto community, but its technical sophistication makes it particularly dangerous.