Widespread Fake CAPTCHA Campaign Delivering Malware

Arctic Wolf has observed a campaign in which compromised websites present a fake CAPTCHA that instructs users to run a command (via the Windows Run dialog), triggering PowerShell execution that ultimately installs information-stealer malware; examples include HEP2go and several auto dealership sites. Arctic Wolf recommends avoiding sites showing such CAPTCHAs, deploying Arctic Wolf Agent and Sysmon for detection, and conducting security awareness training while detections for malicious PowerShell substrings are in place.