Using CAPTCHA for Compromise: Hackers Flip the Script

ReliaQuest reports an active campaign (Sept–Dec 2024) using fake CAPTCHA pages impersonating services like CloudFlare and Google to silently copy malicious commands to victims' clipboards and trick them into executing scripts via Windows Run or PowerShell; the campaign distributes infostealers (Lumma, StealC) and NetSupport RAT, includes IoCs/domains, and documents detection/response guidance and automated playbooks to contain infections.