Beware the ClickFix Con: Malicious PowerShell Scripts Masquerading as Gitcode and DocuSign Sites!
Threat hunters have uncovered a cunning ploy using fake websites that trick users into executing malicious PowerShell scripts, leading to NetSupport RAT infections. These sites, posing as Gitcode and DocuSign, use techniques like clipboard poisoning and deceptive CAPTCHAs to dupe victims. It’s a classic case of “click here for free malware!”
Hot Take:
In the world of cybersecurity, it seems that even the internet’s favorite pastimes—CAPTCHA puzzles and code repositories—aren’t safe from being weaponized by cybercriminals. Who knew that proving you’re “not a robot” could lead to such a human-sized headache?
Key Points:
- Deceptive websites are tricking users into executing malicious PowerShell scripts to install NetSupport RAT malware.
- Fake Gitcode and DocuSign sites are used as lures for unsuspecting users.
- Social engineering tactics over email and social media are suspected methods of propagation.
- CAPTCHA verifications are being used to obfuscate malicious script execution.
- Campaign shares similarities with known threat actors such as FIN7 and SocGholish.
Already a member? Log in here