VORANT. Threat Intelligence Sign in Get the full feed

Fake CAPTCHA deploys Latrodectus, Supper malware

high threat

Polish organisation compromised via fake CAPTCHA attack delivering Latrodectus v2.3 loader and Supper backdoor, demonstrating complete kill chain from user deception to network persistence.

CERT Polska analysed a compromise at a large Polish organisation where attackers used fake CAPTCHA (ClickFix) social engineering to trick users into executing malicious PowerShell commands via Win+R. The attack delivered Latrodectus version 2.3—a previously unanalysed variant employing DLL side-loading, NTDLL unhooking, and anti-debugging techniques. The loader communicated with C2 infrastructure using AES-CTR encrypted strings and retrieved additional payloads.

Two Supper backdoor samples were deployed as follow-on payloads, establishing persistence via scheduled tasks and implementing SOCKS proxy functionality alongside arbitrary binary execution. The Supper malware maintains C2 communication with multiple IPs including 162.19.199.110:4043, 185.233.166.27:443, and others, using custom encryption protocols. CERT Polska reverse-engineered the communication protocol and developed decryption tooling to extract C2 infrastructure.

The investigation revealed multiple compromised Polish domains hosting fake CAPTCHA pages, with embedded but malformed Telegram tokens suggesting possible LLM-generated attack code. This case demonstrates how a single deceived user can provide attackers with immediate code execution and persistent network access, highlighting the effectiveness of social engineering as an initial access vector for pre-ransomware deployment chains.

Mentioned in this report

Malware LatrodectusSupper
Campaigns Kallichore

Detection guidance

Suspicious PowerShell Execution via Run Dialog (ClickFix Pattern)

ATT&CK T1059.001

Detects PowerShell spawned directly from explorer.exe (Win+R Run dialog) with encoded or download-cradle style command lines, consistent with ClickFix fake-CAPTCHA social engineering used to deliver Latrodectus. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious PowerShell Execution via Run Dialog (ClickFix Pattern)
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \\explorer.exe
  selection_proc:
    Image|endswith:
    - \\powershell.exe
    - \\powershell_ise.exe
  selection_cli:
    CommandLine|contains:
    - -enc
    - -EncodedCommand
    - IEX
    - Invoke-Expression
    - DownloadString
    - Net.WebClient
    - -w hidden
    - -windowstyle hidden
  condition: selection_parent and selection_proc and selection_cli
falsepositives:
- Legitimate IT scripts or admin tooling manually launched via Run dialog for automation
- Software deployment agents that momentarily spawn from explorer.exe
level: high
tags:
- attack.t1059.001
- attack.t1204.003
- attack.t1140
id: 88d8343d-9cc9-5d96-8aee-1ced560f512d
status: experimental
author: Vorant

Potential DLL Side-Loading from User-Writable Directory

ATT&CK T1574.002

Detects a legitimate signed executable loading a DLL from a non-standard, user-writable directory (Temp/AppData/ProgramData), consistent with Latrodectus loader's DLL side-loading technique. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Potential DLL Side-Loading from User-Writable Directory
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|contains:
    - \\AppData\\Local\\Temp\\
    - \\AppData\\Roaming\\
    - \\ProgramData\\
    - \\Users\\Public\\
  filter_signed:
    Signed: true
  condition: selection and not filter_signed
falsepositives:
- Portable applications or installers that legitimately keep DLLs alongside their
  executable in Temp or AppData
- Some legitimate updater tools staged in ProgramData
level: medium
tags:
- attack.t1574.002
- attack.t1027.002
- attack.t1140
id: d364019e-a04e-5058-945b-40b24ac23abc
status: experimental
author: Vorant

Scheduled Task Persistence Executing Binary from Temp or AppData

ATT&CK T1053.005

Detects creation of a scheduled task pointing to an executable in Temp, AppData, or ProgramData, consistent with the Supper backdoor establishing persistence after Latrodectus delivery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Scheduled Task Persistence Executing Binary from Temp or AppData
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|endswith: \\schtasks.exe
  selection_create:
    CommandLine|contains: /create
  selection_path:
    CommandLine|contains:
    - \\AppData\\Local\\Temp\\
    - \\AppData\\Roaming\\
    - \\ProgramData\\
    - \\Users\\Public\\
  condition: selection_proc and selection_create and selection_path
falsepositives:
- Legitimate software installers that register update tasks pointing to vendor binaries
  in ProgramData
- Enterprise deployment tools staging executables in AppData before task registration
level: high
tags:
- attack.t1053.005
- attack.t1059.003
id: 580c7cc0-e9e6-5f1c-83b9-2670d9790ec8
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/02/fake-captcha-in-action

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free