CAPTCHA to Command: Trustwave Uncovers Stealthy NodeJS Backdoor Campaign

Trustwave SpiderLabs details the KongTuke campaign which compromises websites to trick visitors with fake CAPTCHA pages that lead to execution of PowerShell commands and deployment of modular NodeJS RATs and associated stealers; the malware uses anti-VM checks, XOR+gzip encrypted C2, persistence via the Windows Registry, and SOCKS5 proxy tunneling, and actors host second-stage payloads via TryCloudflare to evade detection.