LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique
LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA (TL-2026-2441), also tracked as Legion Loader, is a medium-severity malware campaign, first published 2026-09-11. It has no confirmed attribution, affects Microsoft Windows (10/11, PowerShell-capable endpoints), maps to 15 MITRE ATT&CK techniques (T1027, T1055, T1059), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-2441
- Threat ID
- TL-2026-2441
- Also known as
- Legion Loader
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-11
- Last reviewed
- 2026-09-11
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- generalpublic, enterprise
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA
Malware and tooling: Satacom
AhnLab ASEC identified an active campaign distributing LegionLoader, a multi-stage loader/backdoor, via the ClickFix social-engineering technique. Victims reach a fake Cloudflare CAPTCHA page — through a compromised South Korean namu.wiki page or spear-phishing emails impersonating internal account-provisioning systems — that tricks them into pasting and executing malicious PowerShell into the Windows Run dialog or a terminal.
How LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA works
LegionLoader is a multi-stage loader/backdoor malware family, historically documented since December 2019 (SecurityWeek, Deep Instinct) as a malware-as-a-service dropper written in MS Visual C++ 8. In the campaign identified by AhnLab ASEC (published 2026-09-11), the malware is delivered through the ClickFix technique: a fake Cloudflare CAPTCHA verification screen instructs victims to copy a PowerShell one-liner and paste it into the Windows Run dialog or a command prompt, rather than performing a normal button-click or text-entry CAPTCHA challenge.
Two delivery vectors were confirmed. First, attackers inserted malicious links disguised as official content on a South Korean namu.wiki page (the 'Shinon Hope Town' article); visitors are carried through multiple redirect hops before landing on the fake CAPTCHA page. Second, attackers sent spear-phishing emails impersonating an internal account-provisioning system, using urgency (warnings that incorrect password entry would lock the account, and that the account must be activated within a deadline) to drive victims at specific target enterprises to the same fake CAPTCHA flow.
The clipboard payload executes 'powershell -w h -ep bypass -c' with an inline script downloaded via Invoke-RestMethod from a rotating '.monster'/'.cfd' distribution domain, parsed and run in-memory via the PowerShell Language Parser (no script ever touches disk). This retrieves and runs the LegionLoader stage, which sequentially decrypts embedded, encrypted shellcode and PE payloads and executes the final backdoor through a custom PE loader.
Before executing, the loader performs anti-analysis checks: it enumerates display devices via EnumDisplayDevicesA and compares them against 16 blacklisted virtualization/remote-desktop adapter strings (VMware, Hyper-V, VirtualBox, Parallels, Citrix, etc.), and queries ipinfo.io to determine whether its public IP belongs to a hosting-provider ASN (a common sandbox/VPS indicator). If these checks pass, the backdoor supports multiple execution primitives driven from its C2: native PE execution via process hollowing into a suspended RuntimeBroker.exe, shellcode injection into explorer.exe, PowerShell execution with an AMSI bypass, and MSI payload execution via ShellExecute/msiexec. For credential theft, it extracts the Chrome Legacy Master Key and App-Bound Encryption key along with browser profile/history data, enabling decryption of stored Chrome credentials and cookies offline. Persistence is established through Windows Registry Run and RunOnce keys.
C2 communication uses RC4-encrypted, Base64-encoded traffic over HTTP to two confirmed domains (dallasbackstage[.]com and gemscocl[.]com, resolving to 89.34.90.217), each exposing /nfront.php (host registration / command retrieval) and /nback.php (execution-result reporting) endpoints. Distribution infrastructure shows clear operational rotation: ten '.monster'-TLD domains were active in August 2026 (including leappoploaderinstantly[.]monster, the domain observed in the captured PowerShell command), with a brief, overlapping use of a '.com' domain (socialseoguru[.]com), followed by a shift to five '.cfd'-TLD domains in September 2026 — consistent with active adversary infrastructure cycling to evade domain-reputation blocking.
MITRE ATT&CK techniques used in TL-2026-2441
Stealth
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1132 Data Encoding; T1573 Encrypted Channel
stealth
T1218 System Binary Proxy Execution
Persistence
T1547 Boot or Logon Autostart Execution
Credential Access
T1555 Credentials from Password Stores
Initial Access
Resource Development
Reconnaissance
T1589 Gather Victim Identity Information
defense-impairment
Affected products and versions in LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA
- Microsoft — Windows (10/11, PowerShell-capable endpoints)
Vulnerable versions: Windows 10; Windows 11 - Google — Chrome Browser (credential store targeted)
Vulnerable versions: all versions using Legacy Master Key / App-Bound Encryption
Remediation for LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA
Immediate actions
- Block the confirmed C2 domains (dallasbackstage[.]com, gemscocl[.]com) and IP (89.34.90.217) at DNS/perimeter firewall
- Block the confirmed distribution domains across .monster, .cfd, and .com TLDs listed in IOCs
- Hunt for the five listed MD5 hashes across EDR/AV telemetry
- Search PowerShell/AMSI script-block logs for 'irm' invocations against .monster or .cfd domains and for the '-w h -ep bypass' command pattern
- Alert on RuntimeBroker.exe processes created in a suspended state or exhibiting hollowed-memory characteristics
- Force Chrome credential/App-Bound key rotation and re-authentication for any user who ran the clipboard command
Workarounds
- Block execution of PowerShell from Explorer/Run-dialog paste actions via endpoint policy where feasible
- Filter/quarantine inbound email referencing account provisioning/activation with external links pending verification
Longer-term hardening
- Deploy EDR with behavioral detection for process hollowing (T1055.012), AMSI-bypass patterns, and PowerShell abuse
- Restrict PowerShell execution policy and enable Constrained Language Mode / AppLocker for non-admin users
- Deploy Group Policy or endpoint controls that disable the Windows Run dialog's ability to execute pasted multi-stage commands unattended, and monitor clipboard-to-terminal execution patterns (ClickFix detection)
- Run security-awareness training specifically covering ClickFix / fake-CAPTCHA 'verify you are human' prompts that ask users to run commands
Timeline of LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA
- Attackers briefly use a .com-TLD domain (socialseoguru[.]com) alongside the .monster infrastructure during the same period.
- LegionLoader ClickFix distribution campaign begins using a wave of ten newly registered .monster-TLD domains as first-stage staging infrastructure (August 2026).
- Distribution infrastructure rotates from .monster-TLD domains to a new set of five .cfd-TLD domains, consistent with active operational security by the operators (September 2026).
- AhnLab ASEC publishes an English-language advisory corroborating the same LegionLoader ClickFix findings for a broader audience.
- AhnLab ASEC publishes Korean-language advisory documenting the LegionLoader ClickFix campaign, including hashes, domains, and C2 IP.
- Spear-phishing emails impersonating an internal account-provisioning system, targeting specific enterprises, identified driving victims to the same fake CAPTCHA/ClickFix flow.
- Compromised namu.wiki 'Shinon Hope Town' page identified redirecting visitors through multiple hops to a fake Cloudflare CAPTCHA verification page.
Sources cited for LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA
- 보안 인증 창을 위장한 LegionLoader 악성코드 (ClickFix 기법으로 유포)
- I just trusted the security certificate prompt... Beware of the LegionLoader malware being distributed via the ClickFix method
- New Legion Loader Delivers a Variety of Malware
- Untangling Legion Loader's Hornet Nest of Malware
- ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services
- User Execution: Malicious Copy and Paste, Sub-technique T1204.004
- Process Injection: Process Hollowing, Sub-technique T1055.012
More in malware
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain
- Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation
- ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2
- Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)
- SloppyRAT: New Remote Access Trojan Deployed via ClickFix in Ransomware-Linked Attacks
Detection coverage for TL-2026-2441
As of 2026-09-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2441 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.