Fake CAPTCHA websites hijack your clipboard to install information stealers

This report details a widespread clipboard-hijacking technique where malicious websites trick users into allowing clipboard writes and instruct them to paste and execute a command (commonly an mshta call) in Windows Run; mshta then retrieves an encoded payload (often an encoded PowerShell script) that deploys info-stealers such as Lumma Stealer and SecTopRAT. The write-up outlines the attack flow, examples of file types used as lures, and practical mitigations including disabling JavaScript, using anti‑malware/browser-blocking extensions, and cautious user behavior.