Fake CAPTCHA deploys Latrodectus, Supper malware
Polish organisation compromised via fake CAPTCHA attack delivering Latrodectus v2.3 loader and Supper backdoor, demonstrating complete kill chain from user deception to network persistence.
Sourcecert.pl — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
CERT Polska analysed a compromise at a large Polish organisation where attackers used fake CAPTCHA (ClickFix) social engineering to trick users into executing malicious PowerShell commands via Win+R. The attack delivered Latrodectus version 2.3—a previously unanalysed variant employing DLL side-loading, NTDLL unhooking, and anti-debugging techniques. The loader communicated with C2 infrastructure using AES-CTR encrypted strings and retrieved additional payloads.
Two Supper backdoor samples were deployed as follow-on payloads, establishing persistence via scheduled tasks and implementing SOCKS proxy functionality alongside arbitrary binary execution. The Supper malware maintains C2 communication with multiple IPs including 162.19.199.110:4043, 185.233.166.27:443, and others, using custom encryption protocols. CERT Polska reverse-engineered the communication protocol and developed decryption tooling to extract C2 infrastructure.
The investigation revealed multiple compromised Polish domains hosting fake CAPTCHA pages, with embedded but malformed Telegram tokens suggesting possible LLM-generated attack code. This case demonstrates how a single deceived user can provide attackers with immediate code execution and persistent network access, highlighting the effectiveness of social engineering as an initial access vector for pre-ransomware deployment chains.
Mentioned in this report
Detection guidance
Suspicious PowerShell Execution via Run Dialog (ClickFix Pattern)
A behavioural hunt for the technique in general.
Detects PowerShell spawned directly from explorer.exe (Win+R Run dialog) with encoded or download-cradle style command lines, consistent with ClickFix fake-CAPTCHA social engineering used to deliver Latrodectus. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious PowerShell Execution via Run Dialog (ClickFix Pattern)
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \\explorer.exe
selection_proc:
Image|endswith:
- \\powershell.exe
- \\powershell_ise.exe
selection_cli:
CommandLine|contains:
- -enc
- -EncodedCommand
- IEX
- Invoke-Expression
- DownloadString
- Net.WebClient
- -w hidden
- -windowstyle hidden
condition: selection_parent and selection_proc and selection_cli
falsepositives:
- Legitimate IT scripts or admin tooling manually launched via Run dialog for automation
- Software deployment agents that momentarily spawn from explorer.exe
level: high
tags:
- attack.t1059.001
- attack.t1204.003
- attack.t1140
id: 88d8343d-9cc9-5d96-8aee-1ced560f512d
status: experimental
author: Vorant
Scheduled Task Persistence Executing Binary from Temp or AppData
A behavioural hunt for the technique in general.
Detects creation of a scheduled task pointing to an executable in Temp, AppData, or ProgramData, consistent with the Supper backdoor establishing persistence after Latrodectus delivery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scheduled Task Persistence Executing Binary from Temp or AppData
logsource:
category: process_creation
product: windows
detection:
selection_proc:
Image|endswith: \\schtasks.exe
selection_create:
CommandLine|contains: /create
selection_path:
CommandLine|contains:
- \\AppData\\Local\\Temp\\
- \\AppData\\Roaming\\
- \\ProgramData\\
- \\Users\\Public\\
condition: selection_proc and selection_create and selection_path
falsepositives:
- Legitimate software installers that register update tasks pointing to vendor binaries
in ProgramData
- Enterprise deployment tools staging executables in AppData before task registration
level: high
tags:
- attack.t1053.005
- attack.t1059.003
id: 580c7cc0-e9e6-5f1c-83b9-2670d9790ec8
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/02/fake-captcha-in-action
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs