# LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique

> AhnLab ASEC identified an active campaign distributing LegionLoader, a multi-stage loader/backdoor, via the ClickFix social-engineering technique. Victims reach a fake Cloudflare CAPTCHA page — through a compromised South Korean namu.wiki page or spear-phishing emails impersonating internal account-provisioning systems — that tricks them into pasting and executing malicious PowerShell into the Windows Run dialog or a terminal.

- **Published:** 2026-09-11T00:00:00Z
- **Last reviewed:** 2026-09-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2441
- **ID:** TL-2026-2441
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LegionLoader is a multi-stage loader/backdoor malware family, historically documented since December 2019 (SecurityWeek, Deep Instinct) as a malware-as-a-service dropper written in MS Visual C++ 8. In the campaign identified by AhnLab ASEC (published 2026-09-11), the malware is delivered through the ClickFix technique: a fake Cloudflare CAPTCHA verification screen instructs victims to copy a PowerShell one-liner and paste it into the Windows Run dialog or a command prompt, rather than performing a normal button-click or text-entry CAPTCHA challenge.

Two delivery vectors were confirmed. First, attackers inserted malicious links disguised as official content on a South Korean namu.wiki page (the 'Shinon Hope Town' article); visitors are carried through multiple redirect hops before landing on the fake CAPTCHA page. Second, attackers sent spear-phishing emails impersonating an internal account-provisioning system, using urgency (warnings that incorrect password entry would lock the account, and that the account must be activated within a deadline) to drive victims at specific target enterprises to the same fake CAPTCHA flow.

The clipboard payload executes 'powershell -w h -ep bypass -c' with an inline script downloaded via Invoke-RestMethod from a rotating '.monster'/'.cfd' distribution domain, parsed and run in-memory via the PowerShell Language Parser (no script ever touches disk). This retrieves and runs the LegionLoader stage, which sequentially decrypts embedded, encrypted shellcode and PE payloads and executes the final backdoor through a custom PE loader.

Before executing, the loader performs anti-analysis checks: it enumerates display devices via EnumDisplayDevicesA and compares them against 16 blacklisted virtualization/remote-desktop adapter strings (VMware, Hyper-V, VirtualBox, Parallels, Citrix, etc.), and queries ipinfo.io to determine whether its public IP belongs to a hosting-provider ASN (a common sandbox/VPS indicator). If these checks pass, the backdoor supports multiple execution primitives driven from its C2: native PE execution via process hollowing into a suspended RuntimeBroker.exe, shellcode injection into explorer.exe, PowerShell execution with an AMSI bypass, and MSI payload execution via ShellExecute/msiexec. For credential theft, it extracts the Chrome Legacy Master Key and App-Bound Encryption key along with browser profile/history data, enabling decryption of stored Chrome credentials and cookies offline. Persistence is established through Windows Registry Run and RunOnce keys.

C2 communication uses RC4-encrypted, Base64-encoded traffic over HTTP to two confirmed domains (dallasbackstage[.]com and gemscocl[.]com, resolving to 89.34.90.217), each exposing /nfront.php (host registration / command retrieval) and /nback.php (execution-result reporting) endpoints. Distribution infrastructure shows clear operational rotation: ten '.monster'-TLD domains were active in August 2026 (including leappoploaderinstantly[.]monster, the domain observed in the captured PowerShell command), with a brief, overlapping use of a '.com' domain (socialseoguru[.]com), followed by a shift to five '.cfd'-TLD domains in September 2026 — consistent with active adversary infrastructure cycling to evade domain-reputation blocking.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1218 System Binary Proxy Execution
- T1547 Boot or Logon Autostart Execution
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1071 Application Layer Protocol
- T1132 Data Encoding
- T1573 Encrypted Channel

## Sources

- [보안 인증 창을 위장한 LegionLoader 악성코드 (ClickFix 기법으로 유포)](https://asec.ahnlab.com/ko/95373/)
- [I just trusted the security certificate prompt... Beware of the LegionLoader malware being distributed via the ClickFix method](https://asec.ahnlab.com/en/95374/)
- [New Legion Loader Delivers a Variety of Malware](https://www.securityweek.com/new-legion-loader-delivers-variety-malware/)
- [Untangling Legion Loader's Hornet Nest of Malware](https://www.deepinstinct.com/blog/untangling-legion-loaders-hornet-nest-of-malware)
- [ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services](https://thehackernews.com/2026/01/clickfix-attacks-expand-using-fake.html)
- [User Execution: Malicious Copy and Paste, Sub-technique T1204.004](https://attack.mitre.org/techniques/T1204/004/)
- [Process Injection: Process Hollowing, Sub-technique T1055.012](https://attack.mitre.org/techniques/T1055/012/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2441