Fake CAPTCHA and ClickFix Social Engineering Used to Deliver Stealer Malware
Malware Intelligence · 3 sources · Updated 4mo ago · First seen Feb 17, 2026
A wave of social-engineering-driven malware delivery is abusing “verification” and “fix” workflows to trick users into running attacker-supplied commands that install information stealers. LevelBlue reported a campaign using fake Cloudflare-style CAPTCHA pages on compromised websites to convince Windows users to manually execute malicious PowerShell commands, resulting in StealC deployment; StealC is described as exfiltrating browser credentials, crypto wallet data, Steam and Outlook credentials, system information, and screenshots over RC4-encrypted HTTP to a C2 server. Intego also identified an evolved ClickFix technique on macOS (“Matryoshka”) that leverages typosquatting to redirect users to pages instructing them to paste “fix” commands into Terminal; the loader then retrieves an AppleScript payload to steal browser credentials and target wallet apps (e.g., Trezor Suite, Ledger Live), including repeated fake password prompts as a fallback.
Separately, other credential-theft campaigns are also leaning heavily on lures that exploit user trust and routine workflows. Morphisec described Noodlophile evolving from fake AI video platform ads to fake job postings and phishing “assessments,” delivering multi-stage stealers/RATs via techniques including DLL sideloading, while continuing to use Telegram bots for exfiltration/C2 and adding file-bloating content intended to disrupt automated analysis. These developments reinforce that user-in-the-loop execution (copy/paste commands, “verification” steps, and recruitment-themed forms) remains a high-yield initial access vector for stealers across both Windows and macOS environments.
