Fake CAPTCHA Runs Malware
Вставка
- Опубліковано 9 лют 2025
- jh.live/soc || Join me for the SOC Analyst Appreciation Day! A completely FREE event on October 16th by DEVO! jh.live/soc
www.virustotal...
x.com/aruhamm/...
x.com/g0njxa/s...
www.orangecybe...
x.com/Unit42_I...
github.com/Pal...
• MALWARE on a BLOCKCHAI...
denwp.com/anat...
github.com/Joh...
Learn Cybersecurity - Name Your Price Training with John Hammond: nameyourpricet...
Learn Coding: jh.live/codecr...
Don't listen to other "influencer" VPN crap -- host YOUR OWN: jh.live/openvpn
WATCH MORE:
Dark Web & Cybercrime Investigations: • Tracking Cybercrime on...
Malware & Hacker Tradecraft: • Malware Analysis & Thr...
📧JOIN MY NEWSLETTER ➡ jh.live/email
🙏SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎FOLLOW ME EVERYWHERE ➡ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/discord ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware
🔥UA-cam ALGORITHM ➡ Like, Comment, & Subscribe!
dang that's crazy actually though take a look-see at jh.live/training for more and my newsletter at jh.live/newsletter lololol
I just fell for it yesterday. Just 1 hour ago i saw the powershell and felt suspicious
I could definitely see people falling for this. The fatigue among users encountering captchas is real. That's what this relies on.
Let's be real. Elderly people or most of the boomer generation will fall for this and probably some of the younger people, without IT or security background would also.
You're right, but you're technically also wrong. Yes, people are tired of it, but that would actually mean less people would likely fall for it.
Apparently when you're tired of something, you go ahead and interact with it more for some reason, but normal people do not.
They see the thing and they immediately disengage.
I, for example, have closed thousands of pages when I saw a captcha and simply couldn't be bothered because it wasn't important enough.
I am very fatigued of them and therefore stop interacting with not just pages but even whole sites that want me to do even one.
Because I am tired of them, not only will I not do their captcha, I will never use their site again if I suspect I will be forced to do so to get what I wanted out of them in the first place.
You've also clearly never dealt in much YGO if you think that people don't immediately forfeit when seeing their opponent slap down a card from decks they're tired of seeing.
Something that happens because fatigue = disengagement.
@@ardwetha Yeah especially if you offer them free roblox
The crazy thing is this type social engineering attack bypasses browser sandboxing (browser can't launch executables on the host).. pretty ingenuous but scary stuff. All the more reason it's essential to use ad-blocking software.
Yeah if youre based pirating shit at your grandmas house lol.
Nobody who has a job is falling for that shit.
Any child offered vbucks, roblox, etc, playing on their parents/family computer would absolutely fall for this
that's what account systems are for
Don't make toddlers your sysadmin
It's evil genius
I know A LOT of people, who would fall for it
John Hammond when he sees an Western name like Arnold Schwarzenegger: "That's too easy!"
Also John Hammond when he sees basically a four-letter non-Western name: "I'm sorry, I quit."
Schwarze WHAT
To be fair, non western names are generally much harder to pronounce for native English speakers.
@@keulron2290 Yet we've learned to say "Tchaikovsky."
@ Generally.
Unfortunately even the simplest and dumbest trick works for most of the average users, and that's why they keep appearing. Under circumstances, even the most careful may fall for it.
Thank you for this video of analyzing the situation (and to everyone else of course who did the research and spread awareness about it).
I'm very techy careful most of the times etc etc
but then.... friend of mine sends something like
"vote for my [kid] so she would win school something something tournament"
And as we don't really know each other irl I could not have an idea does she actually has children.
consequences confirmed she didn't.
I ran into one of these a few months ago, although the shell command wasn't even encoded back then, it was just plain readable. My first thought was "Is there really someone who does this to them?" Then I realized that most users follow the instructions the machine gives them... Specifically, I reminded everyone in my environment that "We don't run any shell scripts just like that." In today's world, the user is the weak link. 😮💨
its very clever if you think about it. "techy" people would not fall for it, but normal people, would probably fall for it
Even a techy person could fall for it if they're just going through the motions. Never underestimate just how much you've been programmed to follow along with random bullshit processes.
Linus tech tips falls for it
@@MrNaesme hold alt f4 to check if there's malware
people constantly fall for discord login scams and pollute servers with more bot scams, i could see a fake captcha being even more effective than those
Ty that worked @@truthboom
The one John made, I feel, would trick so many people... Much more than the attacker's version shown before that.
seems stupid but the sad part is it works very well for your average user
Maybe because your average user isnt usualy computer enthusiast and have computer as "necessary evil". Usualy as workstation or machine for home use, to play movies and download porn. The technology goes forward so quick even professionals have "heads full" and often dont see the obvious. Lack of time is general issue and if you have deadlines and for example also staff shortage, you will fall for even more stupid things. Thats why there are ICT departments in companies.
Said an apple user....
New fear unlocked.
Guess I am declaring myself as ROBOT.
This is the biggest "facepalm" foothold I have seen in 2024
John, thanks for this. I am doing a write up so to speak on captchas. Mainly because many people who are just users do not know the dangers. Besides the dangers, with AI, these are useless and verification is so much more complicated than I at first assumed. Heck as we speak those working on countering this and find better ways are still finding ways that are better than what they roll-out almost daily, doing a great job for sure but for this I have not quite seen as much research being done. Any rate long story short, much appreciated.
I DON'T BELIEVE IT ... I JUST SAW IT YESTERDAY AND ALMOST FELL FOR IT!!!
me too but when they said Crtl + V i knew something was fishy so why not hack the hackers site
Thank god you didn't provide any info about where you saw it, truly helps people so they don't encounter it.
@@iamyourgreatgreatgreatgrea6291 it was on a pirating website so ... not risking that the website to go down + why tf do u want the website if you know how the hack work?
Never seen this one but just opening something on the computer itself is fishy.
Once you get to the fact that they want you to paste something, it immediately tells you they copied something to your clipboard when you pressed the button.
I can see clicking it (they're constantly changing these systems around for no reason, so the fact that it looks a little different isn't necessarily weird) but the first is just an immediate red flag and the second is a giant rainbow kaleidescope flag unless you don't know copy and paste.
i fell for it today bruh i didnt even notice it because i was multi tasking
Oh God, as soon as I saw the "Verification Steps"... Like others are saying in the comments, most of us know immediately something fishy is going on, but my mom, dad, grandmother etc would all just follow those steps blindly, not knowing what Win+R does or opens, not knowing they're about to paste something that's been set on their clipboard,... It's so scummy from these bad actors, they know exactly that most people have no clue what all of this means. It's so sad, and I feel sorry for every victim. They're paying the price just for not being familiar enough with these things.
This is great😂 I don’t want to be the analyst that has to work up a solution to prevent clients from using the clipboard to evade the browser sandbox. Seriously, always interesting. Also thanks for sharing some of the other examples and writeups showing how our users fall victim to these payloads 🔥🔥
No, but, shouldn't there be a warning when you copy/paste into the terminal, it did that in my old linux system?
Look, when you open web developer tools, there is warning because this is used by scammers to fool non tech people, so why is it not obvious, that anything else where the user is copy/pasting into a field which has connection to terminal, then there should be a warning, preferebly a confirmation via UAC?
When you download a file from the internet, it has certain restricted rights, same should be the case with anything copied from a web site into a terminal or system form field.
Watching a John Hammond and then i get an ad from John Hammond. Now that's marketing at work
For anyone on PC that fell for this:
1. Remove the infected device from the internet.
2. Sign out everywhere if you still have access to your accounts.
3. Using a non-infected device change all your passwords/ recover your accounts if you need to.
4. Using a non-infected device create a bootable installer for your operating system on a thumbdrive.
5. Using the bootable installer wipe your ENTIRE OS drive, every partition, and reinstall.
Source: I got Lumma and this is how I recovered, sadly it changes windows system files so an OS reinstall is mandatory.
Things I lost to the virus: I am now banned on CS2 & lost $2 from my Steam wallet.
Yo quick question. It tried to run chrome in the background where I couldn't see it but I kept closing chrome from task manager and restarted my pc. So do I need to do all this? Given my laptop works just fine but has become slow when I start it. Just gets stuck on a blank screen
@v3dvnt12 If it managed to run at all I recommend doing the entire reset and changing all your passwords, yes.
bro im absolutely pc dumb and i deal with this
okay so i was on my sisters pc and i fell for this
it was on anotehr profile (not admin) and doesnt have much permissions , and not mucj data
it had my spotify so i deleted my spotify since it has my card info
I got a John Hammond ad ln this video haha
Same lol
The more complex things get, the easier simple weapons seem to work.🤔
boom
You'd have to be a robot to complete those steps.
That's so funny
Old people exist. Unfortunately, they are the most targeted
@@ShortBusRejectz Calling old people robots now?
Tech illiterate people exist, and are more common than you think.
@@tsuketsu9889 You don't have to be tech literate to Just Say No. No to clicking any links or buttons in email. No to giving personal info over the phone (or even answering a call). No to running commands. No to doing anything asked that is unusual. In fact I would think being tech illiterate should make it easier. If you don't understand it, don't do it. If in doubt, don't do it.
We need to make Win + R to require you to type "allow pasting" for first time like browser dev tools does. Normies would get stuck behind skill issue.
They'll just add: Type "allow pasting"
i'm starting to think the analyst they are referring to may be me !, I had responded to this exact looking incident with the same IOC'S but I knew the user manually ran this powershell as I could see it in the logs the question was why and how and where did they get the this encoded command. did some digging and came across unusual amounts of redirects and yep came across the download step domain with a fake captcha getting the user to open the run window and paste in the command. very simple but clearly effective.
I posted about the potential for this on Reddit years ago, and no joke was met with so much toxic/know it all replies that i deleted the post. "I told you so" is never a response i want to give in relation to malware.
guess you were right, for better or worse
Reddit moment
I also posted it on reddit lol
Thank you for sharing. I just read this from the news and it freaks me out.
Gladly, it is just so obvious that it is a mallware.
funnily enough my add before this video started was john Hammond talking about deadsec 😅 very cool
I love this, and I know people at work who would have followed along without thought.
The fact they have to do this, is desperate. Problem: Everytime they "invent" a new vector, it's easier to detect them. That multistage-obfuscation is just hilarious.
You're right about that use of copy - I encountered in a pentest I did a few months ago.
I use the old fashioned copy style on my web site because the new is way too advanced, and the old one works, and I assume will also work for a very long time for backwards compatibility. But it's not the browsers fault and not javascripts fault either, it is a security flaw in the OS, that data from an unsafe area is not validated before execution. It's very clever, because it is not directly obvious that it is a security flaw, but it is.
Great breadcrumb on the run dialog. Didn’t know that. 🎉
Thank you for this I run linux (not trying to sound better just use linux as I am on an old pc)still interesting to see what people are trying.
First.. i remember when this video was posted 10 mins ago.. I'm at 12:10. Love the begining and the sponsor of this very video.
just came across this website and found this video.
its back up now
glad there is a barrier between for it to work... if it were the exact same looking captcha AND only need to click, that would be a nightmare! also, i got your DevSecCon 2024 ad on your video around the 9 minutes mark lol, not sure if you pay your self and have 0 gains or a net loss... still was funny seeing your ad playing over your ad!
Hei im a newbie and i think got infected this malware, how to disable and erase the malware? thankyou!
that powershell bloked by EDR in my office. i dont expect that the cyber attack happens in many places
greetings from the Ethical Hacking Indonesia community John !
It's better for people to know even the more simple methods so they don't get overlooked.
Generall you are getting the BAG 🏦🏦🏦😤🙏♥️
Fun fact: The user click on the capcha is required for some browser fearures like going to fullscreen or using clipboard. When it's done in the "contructor" it just throws an error.
This video shined a light on questions I had. ty
Am, I the only one who still now and then, wonders how people's boredom keeps turning...well ugly
😐 😒 🙄 😑
I got an ad while watching this. You were in the ad.
Wow, had a John Hammond Ad on a John Hammond Video 🤣🤣🤣
Surprised this wasn't a thing earlier
woah thanks for sharing
I got a John Hammond snyk ad, on a John Hammond video 😂
These longer videos for me are ok due to somewhat intresting topics you cover but that's just me ^^
I was sus when i saw this captcha and i would have fallen for it, if I was not little educated on some technical stuff, so I googled and here you go found this video.
Bravo!!! But !! I haven't understand bro, there is a lot of high tec information too much to understand, well congratulations that you know too much, but did we got infected finally? is it dangerous ? should I format my pc and keep my data safe on an hdd? what should we do from the moment we did dropped in that f.trap. :)
His hair is like a delicious croissant
Wtf i just got an ad with you in it on your video, thought i was trippin for a sec.
i love clever dynamic testing, but dont like dynamic testing to avoid or get a head start in static testing of malware
2:41 You know it's fake when it downloads an EXE and says "run this to prove you're human"
Will anyone fall for that? Well... for my mom to use the computer, I had to make shortcuts to all the sites she uses on her desktop.
It took her like a week to understand that when she clicks another link it opens a new tab and not closes the other site. When one time by mistake she opened a new tab and it launched a Google search page, she couldn't understand what happend and just wasn't able to use the computer until I came and "fixed it".
She is "just" 50.
Yeah. I'd say she would fall for that if she could figure out what the windows key is.
i appreciate your videos, but judging by video title, i thought its some brand new 0 day drive-by on a click exploit, but all it is, is yet another social engineering hack where you have to do stupid things to win stupid prizes. have you ever showcased drive by exploits though? if there are any, in 2024
There are plenty. I have quite a few.
@@ronpaul9172 "I was busy hoarding computer virus samples while you were out honing your social skills and living a normy life"
@@ronpaul9172 a video with showcasing one would be fun
Oh the irony of hitting Enter being the action that allows the malware to enter your PC.
I encountered this while tired. I had the Run window open, then pressed Ctrl + V (but not on the Run box). My senses caught on, so I closed the Run window without running anything, neither was there anything pasted there.
But after closing Run, I did click on my browser and press Enter. Nothing happened. Again I was on zombie mode but this is what I did. I should be fine, right?
Kinda off topic, but now you point out the Run command order key, it makes me wonder why Microsoft didn't just store the command history as a MULTI_SZ - worried about size limit maybe?
Getting into this video, I was genuinely wondering "are we really talking about the fake captcha that asks for notifications and spam you with ads?"
"Verification Steps"
"CTRL + V and Enter"
Hmm ... seems legit!
is there any way to disable the base64 decoding in powershell commands?
that JS code looks like something that I'd write. Plain SIMPLE!!!
I will click 10 times or verify 10 times because the CAPTCHA loop infinitely then I will block the website from my search engine results. And for me recently some website will jump to a separate page that just have CAPTCHA in the page so if it happens I will not able to tell if that is a fake site or not because the website is show in the search result.
i fell for this the first time i saw it, now i know
clipboard history should be a web permission denied by default.
I already pasted it, and I forgot if I pressed enter or not, I already run multiple scans on my computer using malwarebytes, adwcleaner, and windows security and it says nothing wrong, I already changed my passwords too, but I'm still not sure.
Why are encoded commands allowed in the first place?
Probably because its useful depending on what you want your app to do
Probably a way to deal with horrendously nested quote marks, so you don't have to add nested escape characters.
because encoded commands are actually used
i use it sometimes, a b64 encoded string, instead of dealing with the crazyness of quote marks
but yeah would be better if that gets blocked from being runned by the "run" thing, it is useful but i think it should be limited to running from console or as a command runned by a program
to be clear i used once b64 but it was just for something that i wasnt going to publish, bad idea for shared work imo
But why on Normie computers that should never need to touch CMD?
Your version is even more scary, as it just looks like a coding magic trick.
I started to refuse to do captchas about a year ago for anything except banking or government services. I just click off and find what I need elsewhere. Seeing malware delivered via captcha just reinforces my decision.
Please make more complex reverse enginnering malware videos. maybe show how to do analysis on exe files
What should I do if I fell into the trap?
I just met this today… one of our user ran that code… luckily the file instantly got erased by av.
i just got a auto downloaded file named "SecondS.exe" that windows defender recognized as a "Lumma Stealer".. seems like it was during a redirect chain to a s3 bucket it automatically downloaded it... i didn't open it or anything but i don't know if i got infected with anything also... is there a way i could be sure ?
And another power-user feature about to be removed...
if someone falls for it, what does he do?
I accidentally fell for it ,I then realised I f*** ed up ,I ran multiple full scans which didn’t find anything ,and then closed my computer and changed my passwords from another device ,am I still compromised ,what do I do next
Getting rid of PS5 is the most effective way to prevent modern malware, you do not even need AV.
Sorry to be cynical, but really not an interesting attack vector. John admits this multiple times, and I waited for more to come out of it, but there really wasn't any more substance to it. The Twitter (and UA-cam) comments saying this would fool people are largely missing the point. It's a social engineering technique that has the same motivation that MFA fatigue attacks do, this is not anything new. Appreciate the attempt to give it some relevance by trying to make it more convincing. Also, kinda odd to review the .md file to us in the text editor.
lol I was expecting a drive-by zero-day wth is this 😆
11:34 jai minton with JH low quality face. Lol😅😅
Can't a hacker just delete that registry key to not leave any trace?
This happened to me a few days ago. I would probably have laughed if you told me I would fall for this cheap of a trick, but even still I fell for it and did it while tired. My main concern now is should I wipe my whole C drive, or can i trust antiviruses to detect and delete it. What should i do?
I would try AVs first. I would use Windows Defender, Norton Power Eraser, ADWCleaner, and Hitman Pro.
If they detect nothing, wipe the drive. If one of them detects the injected Lumma stealer and removes it, you are good.
Once you have done that, change your password on everything important, such as Google, Microsoft, your online bank, Facebook, Twitter etc.
If you don't those accounts will probably be compromised soon. Also, don't use a password you've used before. This includes things like adding "123" to the end of one.
And finally, check the exceptions part of Windows Defender and make sure the malware hasn't added itself there before running a scan. If it has, remove it from exceptions first.
@@fred-youtubeI ran several antiviruses and they did find some threats, but I didn't know to look if there was a lumma stealer, and sadly most of my accounts had been compromised at that point. But even then, I still appreciate your help, thanks!
@@Vulcan-t2m Have you changed your passwords yet?
I wonder how come windows defender didnt block the downloaded package? Were there any alerts?
Sir can you give us roadmap for beginner to advance and also the courses that contain things bcz I am also new and faced difficulties about roadmap
Your answer is my mom would fall for that
I fell for it. I thought its just another innocent way of captcha. Now my PC is offline
have you find out what to do???
I don't mean to brag but I'm the one million eight hundred twelve thousand four hundred and thirty second subscriber.
As windows admin windows+R is immediate and final red flag I would need to nope from that site, but for not powerusers it is quite smart way .
Anoter reminder to not use your windows pc with admin priveledges. Have good password on your admin account stored somewhere secure in few safe places digitally or physically (not your notepad or word file without any encription)
I fell for it because I´m a dumdum, how do I fix it?
have u sorted it
lol. hate to admit it .. if i accidentally ran into this at the end of the week .. another time when i m feeling tired .. i’d probably fall for it.
i know people who would fall for it .. simply because there are captcha variations that ask you interact via keyboard as proof.
What to do after being infected?
Resetting my PC did the trick for me. I kept my personal files
@@tanvirahmed5372 Isn't Malwarebytes alone enough as an antivirus?
Neofetch im looking at you
If I click only on the blue indication and open menu I take virus or I'm OK?
Hey John , very good video ! I was wondering if I can help you with more Quality Editing in your videos and make Highly Engaging Thumbnails which will help your videos to get more views and engagement . Please let me know what do you think ?
what antiwirus should i run or do i reinstall windowos??
Dumber is more effective. I sniff convenience winning over.
i have actualy seen this like 1 month ago, the same page but it was sketchy so i closed it
MY EYES!
Is there an any way to get rid of this malware? I fell for it 😅
Me too. Please help 😢
me 2
have yall found out😢
Just got one.
What is the interactive sandbox program used?
Any-?