Dodgy Gamers Targeted In ‘I Am Not A Robot’ Captcha Scam

Cybercriminals are using fake Captcha pages to infect devices with malware such as Lumma Stealer. McAfee Labs says it recently observed “the ClickFix infection chain”, which targeted people downloading cracked gaming software, or who clicked on a phishing email that pretended to be from GitHub. McAfee malware report.

“The ClickFix infection chain operates by deceiving users into clicking on fake Captcha buttons like ‘Verify you are a human’ or ‘I am not a robot’,” McAfee says. “Once clicked, a malicious script is copied to the user’s clipboard. Users are then misled into pasting the script after pressing the Windows key + R, unknowingly executing the malware.



“This method of trickery facilitates the infection process, making it easy for attackers to deploy malware.” McAfee malware report. The company says the use of multi-layered encryption “further complicates detection and analysis, making these attacks more sophisticated and harder to prevent”.

Cracked gaming software offers pirated version of licensed games. McAfee says it is “observing a campaign targeting multiple countries”, and a map of impacted countries includes Australia. McAfee malware report.

“When users search the internet for free or cracked versions of popular video games, they may encounter online forums, community posts, or public repositories that redirect them to malicious links,” McAfee says. Once redirected, “if a user clicks the ‘I’m not a robot’ button, a malicious PowerShell script is copied to their clipboard, and they are prompted to execute it ..

. the website includes JavaScript functionality that copies the script to the clipboard”. It says that in the second vector, users receive phishing emails, often targeting GitHub contributors, urging them to address a fake ‘security vulnerability’: “These emails contain links leading to the same fake Captcha pages.

These pages use the same technique: the malicious script is copied to the clipboard when the user clicks the button, and they are then prompted to execute it.”.