Fake CAPTCHA Scam Tricks Windows Users Into Installing Malware

The report details a ClickFix campaign where compromised legitimate websites display convincing Cloudflare-like CAPTCHA pages that instruct users to paste and run a PowerShell command; this clipboard-based trick executes a multi-stage, largely in-memory chain (Donut-generated shellcode, reflective loading, a VC++ downloader and injection into svchost.exe) to deploy the StealC info-stealer which exfiltrates browser credentials, crypto wallets, Steam/Outlook accounts and screenshots over RC4-encrypted HTTP. The article recommends detection and mitigation measures including monitoring for fileless behaviors and encoded PowerShell, hardening PowerShell execution, applying application control (WDAC/AppLocker), monitoring outbound traffic for C2 indicators, and reducing endpoint credential exposure.