Threat video1:00
TA571 ClickFix Fake CAPTCHA Stealers: Detection & IOCs
Fake CAPTCHAs trick victims into pasting a command that drops DeerStealer or NetSupport RAT. Get 9 detection rules, 28 IOCs and a free Splunk SPL rule.
Read the full threat intel for TA571 ClickFix Fake CAPTCHA Stealers: Detection & IOCs →
Chapters
- 0:00The hook1,672 domains trick victims into pasting malware.
- 0:06The storyVictims paste commands from a fake CAPTCHA.
- 0:11Attack pathClipboard delivers a command; victim runs it blindly.
- 0:26AttributionAttributed to TA571.
- 0:31Indicators of compromise25 indicators to hunt: 5 IPs, 9 domains and 2 URLs, and more.
- 0:38MITRE ATT&CK techniques16 ATT&CK techniques, from initial access to command and control.
- 0:44Remediation11 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:001,672 domains trick victims into pasting malware.
0:06Victims paste commands from a fake CAPTCHA.
0:09Malware steals browser data.
0:12Clipboard delivers a command; victim runs it blindly.
0:15VBScript downloads MSI; CCleaner DLL injects into processes.
0:21WebSocket C2 exfiltrates stolen data.
0:26Attributed to TA571. Confidence: low.
0:3225 indicators to hunt: 5 IPs, 9 domains and 2 URLs, and more.
0:3916 ATT&CK techniques, from initial access to command and control.
0:4411 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.