Fake Captcha Ecosystem Exploits Trusted Web Infrastructure to Deliver Malware

A large-scale campaign leverages fake CAPTCHA verification pages hosted on approximately 9,494 compromised websites to trick users into installing malware. Attackers deploy diverse delivery methods — clipboard-driven PowerShell/VBScript downloaders, MSI installer-based installs, and a fileless Matrix Push C2 model that abuses browser notification permissions — enabling numerous payload variants and making traditional payload-centric detection less effective.