➤Summary
Spoofing detection is becoming increasingly important as attackers combine familiar brands, compromised websites, legitimate cloud services and unconventional delivery infrastructure to distribute malware. A campaign analyzed by Cisco Talos and reported by GBHackers uses a fake Google CAPTCHA, ClickFix social engineering, WebDAV, Cloudflare Workers and BNB Smart Chain smart contracts to deliver the Amatera information stealer.
The campaign illustrates a broader problem for security and brand protection teams: a malicious operation does not necessarily require an obviously fraudulent domain or conventional malware download. Instead, attackers can abuse trusted visual cues and legitimate technologies to persuade users to execute the attack themselves.
What Happened in the Fake Google CAPTCHA Campaign?
Cisco Talos began investigating the activity after observing a DLL named verification.google executing from a WebDAV path at a Ukrainian government organization in April 2026. Talos assesses with moderate confidence that the activity was part of a broader cryptocurrency and credential-theft operation rather than a targeted attack against that organization.
Further investigation uncovered a related loader called pf.ch, allowing researchers to reconstruct an earlier stage of the infection chain. Both branches ultimately deliver Amatera, also known as ACR Stealer, a malware family focused on credentials and cryptocurrency-related information.
The important defensive lesson is that the attack chain crosses several security boundaries:
- A compromised website provides the initial access point.
- A Cloudflare Worker injects malicious JavaScript.
- BNB Smart Chain contracts store and deliver additional code.
- A fake Google CAPTCHA creates the social-engineering lure.
- WebDAV provides remote access to the next-stage DLL.
- exe is abused to execute the loader.
- Amatera performs information theft.
- Secondary payloads can provide additional capabilities.
This layered approach complicates detection because no single component necessarily looks malicious in isolation.
How the Fake CAPTCHA Uses ClickFix Social Engineering
The campaign uses a technique commonly described as ClickFix. Instead of exploiting a browser vulnerability, the attacker convinces the victim that a verification step requires manual action.
On Windows systems, the fake CAPTCHA-style interface instructs the visitor to open the Windows Run dialog, paste content from the clipboard and press Enter. That action causes the victim’s own system to initiate the next stage of the attack.
This is significant because the user becomes part of the execution chain. Traditional browser-based defenses may have fewer opportunities to stop the final action when a legitimate system utility is being invoked by the user.
The technique also demonstrates why visual trust matters. A CAPTCHA is normally associated with legitimate websites and anti-bot protection. Reproducing that familiar interaction can make a malicious instruction appear routine.
CISA and the FBI have separately documented malware campaigns using fake CAPTCHA instructions that persuade users to open Windows Run and paste attacker-supplied content, demonstrating that this social-engineering pattern is not limited to a single campaign.
Why WebDAV and BNB Smart Chain Matter
The campaign does not depend entirely on traditional malware-hosting infrastructure.
WebDAV is abused to provide access to a remotely hosted DLL. This makes the delivery mechanism different from the conventional pattern of downloading an executable to a local directory and launching it directly.
The operation also uses BNB Smart Chain as a storage mechanism for JavaScript. Talos describes this as EtherHiding, where malicious code or configuration is stored in blockchain smart-contract data and retrieved by the browser-stage infrastructure.
This provides an important resilience advantage to attackers. Blockchain-hosted content is not managed like an ordinary web page, meaning defenders cannot simply remove the underlying smart-contract data through the same abuse process used against a conventional website.
The combination creates a distributed attack chain:
Compromised website → injected JavaScript → blockchain-hosted instructions → fake CAPTCHA → user execution → WebDAV → loader → information stealer
For defenders, that means investigation needs to cover both the visible website and the infrastructure referenced by its scripts.
What Does Amatera Steal?
The primary payload identified in the Talos investigation is Amatera, an information stealer focused on credentials and cryptocurrency-related data. The broader activity can also deliver secondary payloads, including ZigCryptoStealer and NetSupport Manager depending on the infection branch.
The potential exposure therefore extends beyond a single browser password.
Information-stealing malware can be particularly damaging because compromised credentials may provide access to cloud services, developer platforms, cryptocurrency wallets, communication applications and corporate accounts. Talos observed collection capabilities involving browsers, extensions, password managers, messaging applications, cryptocurrency wallets and other sensitive information.
Security teams should therefore treat evidence of this infection chain as a potential credential-exposure event rather than simply a blocked malware download.
Why Spoofing Detection Needs More Than Domain Matching
The campaign demonstrates an important limitation of conventional domain-focused monitoring. A suspicious domain is useful evidence, but attackers can also compromise legitimate websites and abuse trusted services.
That means spoofing detection should be considered one component of a broader external threat-intelligence process.
A useful investigation can correlate:
- Brand and domain similarity
- Newly registered domains
- DNS and hosting changes
- Certificate Transparency activity
- Website content
- Login and credential-harvesting forms
- Redirect behavior
- Malicious JavaScript
- Threat-intelligence classifications
- External infrastructure relationships
- Advertising or search-engine abuse
SpoofGuard currently describes monitoring across domain registrations, DNS, SSL and Certificate Transparency data, website content, threat-intelligence feeds and other external indicators. Its technology page also describes typo-squatting, homoglyph, bitsquatting and other look-alike discovery techniques.
For organizations investigating campaigns like this, the objective is not to label every similar domain as malicious. Domain similarity is only one signal. Analysts should establish whether a domain is merely similar, suspicious, actively impersonating a brand, or actually delivering malicious content.
How Lookalike Domain Monitoring Supports Investigation
Lookalike domain monitoring can help identify infrastructure that attempts to exploit brand familiarity before a campaign reaches customers or employees.
A domain monitoring service can also provide context around lifecycle changes. A previously parked domain that suddenly begins serving a brand impersonation page deserves different attention from an unrelated domain that merely contains a similar word.
SpoofGuard’s published platform information describes monitoring of new registrations, DNS changes, SSL certificates, website content and infrastructure indicators, alongside risk scoring and alerting.
That type of external visibility can complement endpoint, email, DNS and identity controls. It should not replace EDR, secure email gateways, MFA, SIEM, DNS security or incident-response processes.
What Security Teams Should Investigate
When a user or endpoint encounters a fake CAPTCHA campaign, defenders should investigate the complete chain rather than focusing only on the final malware alert.
1. Identify the initial website
Determine which page the user visited and whether the website was compromised or intentionally malicious. Preserve relevant URLs, timestamps and screenshots where appropriate.
2. Review browser activity
Look for unusual redirects, JavaScript execution, clipboard manipulation and connections to unfamiliar infrastructure.
3. Investigate WebDAV activity
Review endpoint and network telemetry for unexpected WebDAV access, especially when it precedes execution by a Windows system utility.
4. Examine process activity
Investigate unusual relationships involving browser processes, rundll32.exe, scripting engines and other legitimate utilities.
5. Assess credential exposure
If Amatera or another information stealer executed successfully, assume potentially exposed credentials require investigation. Prioritize password resets, session revocation and review of authentication activity according to the organization’s incident-response procedures.
6. Expand external monitoring
Search for related domains, certificates, infrastructure changes and brand impersonation pages. A single detected website may represent only one component of a larger campaign.
Security Checklist for ClickFix-Style Threats
Security and brand protection teams should consider the following controls:
- Monitor newly registered domains associated with corporate brands.
- Track suspicious website-content changes.
- Monitor SSL and Certificate Transparency records.
- Investigate unexpected WebDAV activity.
- Alert on unusual browser-to-system execution chains.
- Educate employees that CAPTCHA pages should not require arbitrary command execution.
- Use Employee phishing simulation software to reinforce recognition of unusual verification prompts.
- Correlate endpoint, DNS, web and domain-intelligence telemetry.
- Preserve evidence before requesting infrastructure remediation.
- Monitor related domains after an incident is identified.
- Revoke potentially exposed credentials when malware execution is confirmed.
The key behavioral indicator is simple: a legitimate CAPTCHA should not require a user to execute an unknown command through Windows Run or another system utility.
How Domain Monitoring Supports the Wider Defense
Brand protection teams often operate outside the traditional SOC workflow, but campaigns such as this show why the two functions increasingly overlap.
A phishing or malware campaign may begin with a compromised third-party website, a lookalike domain or a malicious advertisement. Domain intelligence can provide an external perspective that endpoint telemetry cannot.
SpoofGuard’s use-case documentation describes brand protection, phishing detection, continuous monitoring, infrastructure analysis and takedown workflows as components of its platform.
Its recent coverage of fake CAPTCHA and TerminalFix activity also illustrates why domain monitoring needs to account for more than simple domain-name similarity.
For MSSPs, the same principle can be applied across multiple customer brands. Monitoring domain registrations, website changes and phishing infrastructure can help providers identify emerging impersonation activity and give clients external evidence that complements their existing SOC and MDR services.
Frequently Asked Questions
What is ClickFix?
ClickFix is a social-engineering technique in which a webpage presents an apparently legitimate instruction, often a fake verification or CAPTCHA prompt, and persuades the user to copy and execute attacker-controlled content. The technique shifts part of the execution process onto the victim’s own system.
Can a fake CAPTCHA infect a computer without exploiting the browser?
Yes. The campaign described by Talos relies heavily on user interaction rather than requiring a browser vulnerability. The victim is manipulated into opening a system utility, pasting clipboard content and executing it. This makes security awareness and behavioral detection important defensive layers.
Why would attackers store malware-related code on a blockchain?
Blockchain-based storage can make infrastructure more resilient to conventional takedown processes. In the observed campaign, BNB Smart Chain contracts were used to retrieve JavaScript, allowing attackers to change content without modifying the compromised website itself.
Does detecting a suspicious domain prove that a brand was compromised?
No. A similar or suspicious domain does not prove that the legitimate organization was compromised. Analysts should distinguish domain similarity from observed malicious behavior and independently confirmed organizational compromise.
Strengthen Spoofing Detection Across the External Attack Surface
Organizations facing ClickFix, phishing and malware-delivery campaigns need visibility beyond endpoint alerts. SpoofGuard provides domain threat intelligence and brand-protection monitoring focused on lookalike domains, phishing activity, website analysis and external infrastructure. Teams can use its domain threat intelligence platform, review its technology and detection methods, or explore its phishing detection use cases to assess how external domain intelligence can complement existing security operations. A 7-day free trial is also available for organizations evaluating continuous domain monitoring.
Disclaimer: Spoofguard reports on publicly available threat-intelligence sources. Inclusion of an organization in an article does not imply confirmed compromise. All claims are attributed to external sources unless explicitly verified.