GBHackers reports fake Cloudflare CAPTCHA lures hide malware in PNG images

What happened

GBHackers reports that threat actors are extending the “ClickFix” technique beyond its usual role of delivering scripts and infostealers. The article attributes the underlying findings to Huntress, and the article is the only source here. GBHackers says the lures usually start with a counterfeit Cloudflare “Verify that you are human” turnstile. Victims reach it through Bing malvertising, SEO poisoning or compromised websites.

According to GBHackers, checking the box copies a PowerShell command to the clipboard. The article says attackers now add convincing output to the paste step, such as colored “verification” messages or animated progress bars. It describes two example entry points: a victim who searched for “Westlaw” and clicked a paid ad that led to a typosquatted domain, and a dental practice site whose consent pop-up led to the fake turnstile.

In the steganography case, GBHackers says the pasted command showed a fake Cloudflare check while dropping verify_pkg.zip into the Temp folder. The article says the archive held a signed Microsoft binary (LockScreenContentServer.exe), a rogue DLL and a batch file (1.bat) that launched a multi-stage PowerShell stager. The stager reportedly fetched benign-looking PNGs carrying executable binaries in their pixel data, rebuilt them on disk, ran them, and set up persistence through a scheduled task and a Run key. Huntress says this differs from its earlier steganography case, in which images hid only shellcode instructions, according to GBHackers.

GBHackers also describes a chain found by researcher John Hammond that used the browser cache as a staging area. A compromised dental site reportedly saved a 17,635-byte file into the cache. The ClickFix command then searched the Firefox, Chrome or Brave cache for a file of that exact size, copied it to Temp as a batch file and executed it.

The article reports more serious post-compromise activity in other cases attributed to Huntress:

• Early September incident: a ClickFix command downloaded cf_verify.zip and sideloaded a malicious CertEnroll.dll. Active Directory reconnaissance and a reverse SSH tunnel followed, and the attacker then reportedly used WinRM to reach the primary domain controller and created a new account.
• February intrusion: the Matanbuchus 3.0 loader and AstarionRAT, with movement via PsExec.
• May incident: the Potemkin loader, RMMProject and EtherRAT, spread with SMBExec to 11 hosts.
• Other campaign: DuskDesk, a Node.js RAT disguised as a remote monitoring tool.

What is not confirmed: the sources do not name the threat actor or actors, do not give the total number of victims, and offer no independent verification beyond GBHackers relaying Huntress. No CVE or vendor patch is mentioned. The article does not state that Cloudflare’s own services were compromised, only that its branding is imitated.

Am I affected?

Based on the GBHackers report, exposure depends on user behavior rather than a software flaw. Windows users who land on a fake “Verify that you are human” page and follow its instructions to paste a command are the ones described in the cases. The article names Bing malvertising, SEO poisoning and compromised websites as entry routes. It also mentions macOS (AMOS stealer, via a fake Google Doc prompt) among related lures.

Indicators listed in the article, defanged as published:

• vvestalw.ghost[.]io, a typosquatted redirector shown after the Bing search
• moziw[.]com/vvestalw/, an additional redirector
• westlaw-signon[.]com, the ClickFix landing page
• cf_verify.zip, a staged ZIP written to the user’s temporary directory
• 23.227.199[.]41, the reverse SSH tunnel destination in the September case
• 167.148.201[.]104 on port 3861, contacted by DuskDesk

What to do now

1. Tell users that no legitimate CAPTCHA asks them to paste commands into Run, PowerShell or a terminal, as GBHackers states.
2. Alert on browsers spawning cmd or PowerShell, which GBHackers lists as a defender recommendation.
3. Watch for batch files copied from browser cache folders, unexpected Run keys and scheduled tasks, and outbound SSH from workstations, per the same article.
4. Where users do not need the Windows Run dialog, restrict it. The article notes this removes a common ClickFix path, though attackers can still ask users to open PowerShell or the command prompt.
5. Search logs for the indicators above, re-fanging them only inside controlled tools such as a SIEM, as the article advises.

Sources

• GBHackers: Hackers Use Fake Cloudflare CAPTCHA Checks to Deploy Malware Hidden Inside PNG Images