Loading story…
Security researchers reported a sharp rise in "paste-and-run" phishing, a social-engineering technique that tricks users into executing attacker-supplied commands by pasting them into Windows tools such as the Run dialog or PowerShell. In these attacks, a lure page covertly places an obfuscated command on the victim's clipboard and presents steps framed as a verification or troubleshooting task, often through a fake CAPTCHA. Red Canary said the method expanded significantly in 2025 and became the second most common initial access vector it observed after traditional phishing, delivering payloads including information stealers, remote management tools, loaders, and cryptominers.
One documented campaign targeted GitHub users with spoofed security alerts claiming critical flaws in their repositories. Victims were sent to github-scanner[.]com, where a fake CAPTCHA instructed them to press Windows+R, Ctrl+V, and Enter, causing PowerShell to run clipboard-pasted malicious code that downloaded l6e.exe; VirusTotal analysis identified the payload as Lumma Stealer, a credential-theft malware. Researchers also warned that variants such as FileFix abuse the Windows File Explorer address bar to run commands, and similar lures have appeared on macOS through fake sites impersonating trusted tools such as Homebrew to distribute Odyssey and Atomic Stealer.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Red Canary documented that the KongTuke activity used both fakeCAPTCHA and FileFix variants during 2025. FileFix abuses the Windows File Explorer address bar to execute attacker-supplied commands as part of the same copy-and-paste social engineering pattern.
Red Canary reported that malicious copy-and-paste, or "paste-and-run," expanded significantly during 2025 and became the second most popular initial access vector after traditional phishing. The technique was used to deliver multiple payload types including information stealers, remote management tools, loaders, and cryptominers.
A phishing campaign sent spoofed GitHub security emails claiming critical vulnerabilities in recipients' repositories and directed victims to github-scanner[.]com. The site used a fake CAPTCHA to trick users into pasting and executing malicious PowerShell commands via Windows Run, which downloaded and launched l6e.exe identified as Lumma Stealer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple **Lumma Stealer** infection chains that begin with fake CAPTCHA or verification pages and trick Windows users into launching malicious PowerShell from the Run dialog. In one case, victims reached the lure through malicious pop-up ads on a pirated-content site; in another, a page at `you-checked.com` copied a hidden command to the clipboard that fetched follow-on payloads from domains including `ferrydero.com` and `fill-tomap.com`. The malware family, also known as **LummaC2**, is a malware-as-a-service infostealer designed to steal browser data, credentials, cryptocurrency wallets, session tokens, and other sensitive information. The observed chains used `mshta.exe`, obfuscated HTA and JavaScript, layered PowerShell stages, and multiple packed .NET components to retrieve and execute the final payload while evading analysis. Analysts reported AES and XOR decryption, SmartAssembly and .NET Reactor packing, AMSI bypass attempts, anti-sandbox and anti-debugging checks, Windows Defender evasion, and cleanup steps such as deleting downloaded archives after execution. One intrusion created files under `C:\ProgramData`, contacted `iplogger.co`, and launched an infostealer executable named `jegule.exe`, while another sample ultimately communicated through `winhttp.dll` and `ws2_32.dll`; investigators also recovered additional URLs from a Steam Community profile using ROT15 decoding.
Jul 7, 2026
Multiple reports highlighted **ClickFix**-style social engineering that convinces users to paste attacker-supplied commands into a terminal, leading to infostealer installation. Malwarebytes documented a macOS lure impersonating *CleanMyMac* via `cleanmymacos[.]org`, where victims are instructed to run a Terminal command that prints a reassuring message, decodes a hidden (base64) destination, and then downloads and executes a remote shell script via `zsh`. The resulting payload installs **SHub Stealer**, which targets saved passwords, browser data, Apple Keychain contents, Telegram sessions, and cryptocurrency wallets; it can also tamper with wallet applications (e.g., *Exodus*, *Atomic Wallet*, *Ledger Live*) to enable later theft of recovery phrases. Microsoft threat intelligence (as reported by The Hacker News) described a parallel **Windows** ClickFix campaign that shifts from the traditional Run-dialog paste to **Windows Terminal** (`wt.exe`) using the `Win + X → I` shortcut, exploiting the tool’s administrative legitimacy to reduce suspicion and evade detections tuned to Run-dialog abuse. In that chain, users paste a hex-encoded/XOR-compressed command that spawns additional Terminal/PowerShell stages to decode scripts, download a ZIP payload plus a legitimate-but-renamed **7-Zip** binary, extract additional components, establish persistence via **scheduled tasks**, configure **Microsoft Defender exclusions**, and ultimately deploy **Lumma Stealer** (including use of `QueueUserAPC()` for injection).
Jun 29, 2026
A wave of **social-engineering-driven malware delivery** is abusing “verification” and “fix” workflows to trick users into running attacker-supplied commands that install information stealers. LevelBlue reported a campaign using **fake Cloudflare-style CAPTCHA pages** on compromised websites to convince Windows users to manually execute malicious **PowerShell** commands, resulting in **StealC** deployment; StealC is described as exfiltrating browser credentials, crypto wallet data, Steam and Outlook credentials, system information, and screenshots over **RC4-encrypted HTTP** to a C2 server. Intego also identified an evolved **ClickFix** technique on macOS (“**Matryoshka**”) that leverages **typosquatting** to redirect users to pages instructing them to paste “fix” commands into Terminal; the loader then retrieves an AppleScript payload to steal browser credentials and target wallet apps (e.g., *Trezor Suite*, *Ledger Live*), including repeated fake password prompts as a fallback. Separately, other credential-theft campaigns are also leaning heavily on lures that exploit user trust and routine workflows. Morphisec described **Noodlophile** evolving from fake AI video platform ads to **fake job postings** and phishing “assessments,” delivering multi-stage stealers/RATs via techniques including **DLL sideloading**, while continuing to use **Telegram bots** for exfiltration/C2 and adding file-bloating content intended to disrupt automated analysis. These developments reinforce that user-in-the-loop execution (copy/paste commands, “verification” steps, and recruitment-themed forms) remains a high-yield initial access vector for stealers across both Windows and macOS environments.
Jun 29, 2026