Microsoft Threat Intelligence has identified a cyberattack where hackers breach trusted websites to deploy malicious JavaScript.. This scheme tricks users into executing commands via a fake CAPTCHA, leading to the installation of various stealers and remote access tools.
The Blockchain Smart Contract Shielding Attackers
The most alarming aspect of this campaign is the use of a blockchain-deployed smart contract to manage the attack infrastructure. According to Microsoft Threat Intelligence, the malicious JavaScript injected into compromised websites communicates directly with this contract to coordinate the attack. Because only the owner of the specific cryptocurrency wallet that deployed the contract can modify or delete its contents, the infrastructure is significantly more resistant to the conventional takedown efforts typically used by security firms to kill malicious domains.
Once a victim lands on a compromised site, they are presented with a fake CAPTCHA. This social engineering tactic instructs the user to open the Windows Run dialog, paste contents from their clipboard, and execute a command. By leveraging the user's own system tools to initiate the infection, the attackers can often bypass traditional browser-based security warnings that would otherwise flag a direct file download.
Lumma Stealer and XWorm: The Payloads Behind the CAPTCHA
The commands pasted by victims are not simple scripts but gateways for a variety of high-impact malware. As Microsoft reported, the successful execution of these commands can deliver payloads including Lumma Stealer, XWorm, AsyncRAT, and MintsLoader,as well as various remote management tools. These tools are designed to exfiltrate sensitive credentials and provide attackers with persistent access to the infected machine.
The risk extends beyond simple data theft. Microsoft Threat Intelligence warns that the exposure of credentials through these stealers can ultimately pave the way for human-operated ransomware attacks. In these scenarios, the initial malware serves as the "beachhead," allowing human attackers to move laterally through a corporate network to encrypt high-value data and demand payment.
From June's Crypto Clippers to May's macOS Infostealers
This attack is part of a broader, escalating trend of clipboard-based social engineering. This current campaign echoes a cryptocurrency clipper operation disclosed by Microsoft in June, which stole clipboard contents and swapped wallet addresses to divert funds. It also follows a pattern seen in May, when researchers identified an infostealer campaign that targeted macOS users through fraudulent troubleshooting guides.
These events suggest a shift toward "ClickFix" style attacks, where the attacker relies on the victim to perform a manual action—like pasting a command—to bypass security software.. By abusing legitimate Windows utilities such as PowerShell, Command Prompt, Windows Terminal, mshta, and rundll32, the attackers hide their activity within the noise of standard system operations, making detection significantly harder for basic antivirus software.
Who Owns the Wallet Controlling the Malicious Contract?
Despite the technical details provided by Microsoft, several critical pieces of the puzzle remain missing . Specifically, the identity of the wallet owner who deployed the blockchain smart contract remains unknown, leaving a gap in the attribution of the attack. it is also unclear how many legitimate websites have already been compromised or which specific industries are being targeted most aggressively.
To counter these threats, Microsoft recommends that organizations enable PowerShell logging and restrict unnecessary command-line utilities. Furthermore, the company urges users to never paste commands from CAPTCHAs or browser warnings and suggests that organizations activate the network, web, and cloud protections found in Microsoft Defender to block the initial communication with the malicious blockchain infrastructure.
Comments 0