Cybersecurity firm Netskope Threat Labs has uncovered a massive campaign that has infected thousands of legitimate small‑business websites across more than 2,200 organizations worldwide. The attackers embed malicious code that displays a fake CAPTCHA, then instructs visitors to open the Windows Run dialog and paste a command that downloads and launches malware.
How the scam works
When a user lands on a compromised site, the page may appear normal until a blurred screen shows a CAPTCHA‑style prompt. Instead of a simple “click the box” check, the page tells the visitor to open Windows Run (or PowerShell/Command Prompt) and paste a cryptic command. Executing that command gives the attacker full control of the computer, allowing them to install ransomware, spyware, or other malicious payloads.
Scope of the problem
Netskope reports more than 5,400 compromised websites, with several hundred active on any given day and over 300 contacting the malicious infrastructure each weekday. The victims span a wide range of small businesses – from local clinics and plumbing services to online stores – many of which run WordPress or PrestaShop platforms. The researchers have not yet identified the initial vulnerability that allowed the attackers to gain access.
Why the attackers use blockchain
Unusually, the campaign stores its instructions on a smart contract on the BNB Smart Chain test network. By using a blockchain testnet, the criminals obtain inexpensive, hard‑to‑shut‑down infrastructure. The smart contract can be updated at any time, allowing all compromised sites to receive new commands without the attackers having to modify each site individually.
New variant using WebRTC
In addition to the fake CAPTCHA method, Netskope discovered a newer version that bypasses the CAPTCHA entirely. This variant leverages WebRTC, a browser technology normally used for video calls, to create an encrypted data channel that streams malicious code directly to the victim’s browser, avoiding the need to write a file to disk.
What users can do
Experts recommend a few simple habits to stay safe:
- Never open Windows Run, PowerShell, or Command Prompt from a web page, and never paste commands provided by a website.
- Recognize that a legitimate CAPTCHA will never require you to change system settings or run commands.
- Keep antivirus software up to date and enable real‑time protection.
- Install operating‑system and browser updates through official channels only.
- If you accidentally follow a suspicious prompt, disconnect from the internet, run a full system scan, and change passwords on a trusted device, enabling multi‑factor authentication where possible.
Advice for website owners
Small‑business owners should audit the integrity of their content‑management system files. Netskope advises checking for unauthorized JavaScript, hidden plugin directories, and outdated plugins. Regularly updating WordPress, PrestaShop, and any extensions, and removing unused plugins, can reduce the attack surface. While the exact initial breach method remains unknown, these best‑practice steps are essential for protecting both the business and its customers.
Bottom line
The fake CAPTCHA scam demonstrates how ordinary‑looking web pages can be weaponized to hand control of a computer to cybercriminals. By staying vigilant, keeping software current, and refusing any web‑based request to run system commands, users can protect themselves and help keep their local businesses safe from this evolving threat.
Original reporting: Fox News (HLL/CB) — read the source article.
