The CAPTCHA Trap: ClearFake Malware Tricks Users Into Hacking Themselves

A sophisticated campaign named ClearFake lures users with fake CAPTCHA prompts that instruct victims to paste a malicious PowerShell command from their clipboard; attackers then abuse a vulnerable Windows script (SyncAppvPublishingServer.vbs) to execute PowerShell stealthily. The campaign stores Base64-encoded JavaScript payloads in immutable Binance Smart Chain smart contracts ("EtherHiding") and leverages jsDelivr CDN to frustrate blocking, enabling takedown-resistant distribution; researchers estimate ~150,000 infections since August 2025.