“Clipboard Hijacking” A Fake CAPTCHA Leverage Pastejacking Script Via Hacked Sites To Steal Clipboard Data

Unit 42 describes the "KongTuke" campaign where compromised legitimate websites inject scripts that redirect visitors to fake CAPTCHA pages which silently place a malicious PowerShell command in the clipboard; users are socially engineered to paste and run it, causing the system to contact remote IPs/domains for further payloads and C2 communications—IOCs are provided but the final payload remains unidentified.