The “Fake CAPTCHA” Trap: Malware Hides in Google Calendar & Images

This report from The Blackpoint SOC describes a sophisticated Fake CAPTCHA campaign that coerces users into executing commands via the Windows Run dialog, abuses the legitimate SyncAppvPublishingServer.vbs (a LOLBIN) to mask execution, fetches live configuration from a public Google Calendar, and retrieves an encrypted payload hidden in PNG images (steganography) which loads the Amatera Stealer to harvest browser data and credentials.