Malicious CAPTCHA delivers Lumma and Amadey Trojans
securelist.com
Malicious CAPTCHA distributed through ad networks delivers the Amadey Trojan or the Lumma stealer, which pilfers data from browsers, password managers, and crypto wallets.
  • Telorand@reddthat.comEnglish
    301·
    7 days ago

    The Trojans are distributed through CAPTCHAs with instructions. Clicking the “I’m not a robot” button [for example] copies the line powershell.exe -eC bQBzAGgAdABhA<…>MAIgA= to the clipboard and displays so-called “verification steps”:

    • Press Win + R (this opens the Run dialog box);
    • Press CTRL + V (this pastes the line from the clipboard into the text field);
    • Press Enter (this executes the code).

    Malicious use of the system clipboard seems to be the popular choice, these days. If you fall for this, maybe the internet isn’t the place for you, just yet.

    • ug01x@lemmy.worldEnglish
      8·
      7 days ago

      This really is the computer virus equivalent of those scammer calls where the only way for someone to avoid jail time, or something else bad, is for you to go and buy hundreds of dollars worth of gift cards and send the codes.

      • Telorand@reddthat.comEnglish
        4·
        7 days ago

        My BiL actually fell for one of those. He’s profoundly naive, and it’s probably good that he’s in the military, since they make many of life’s choices for him.