LegionLoader Campaign Uses Fake Cloudflare CAPTCHA Pages to Deliver PowerShell Commands

Sep 2, 2026 · Original article ↗

Summary

ASEC describes LegionLoader campaigns using malicious links and spear-phishing emails to direct users to fake Cloudflare CAPTCHA pages, where copied PowerShell commands download and execute the malware.

Key points

ASEC identified two delivery routes: a malicious link posted on a Korean Namu Wiki page and spear-phishing emails posing as internal account setup instructions.
Both routes lead through redirects to fake Cloudflare CAPTCHA pages that instruct users to run commands copied to the clipboard.
The PowerShell commands download additional scripts and files, which execute LegionLoader through multiple stages.
LegionLoader checks display-device information and the public IP’s ASN type to identify virtualized, remote, or hosting-provider environments.
The final backdoor receives commands from C2 servers and can execute PE files, shellcode, PowerShell scripts, and MSI files, among other functions.
The backdoor can collect Chrome master and app-bound encryption keys and browser history, establish persistence, and use process injection or process hollowing.
ASEC advises users not to run commands requested by web pages under the guise of CAPTCHA verification.

Article Details

Attack Vectors: ClickFix pages disguised as Cloudflare CAPTCHA screens trick users into manually executing malicious PowerShell commands.
A malicious URL posted on the Namu Wiki page for Korea’s “Newlywed Hope Town” redirects users to the fake CAPTCHA page.
Spear-phishing emails impersonate instructions for issuing and activating accounts on targeted companies’ internal business systems and direct recipients to malicious URLs.
The PowerShell commands download and execute additional PowerShell code and malicious files, leading to LegionLoader execution.
Defensive Notes: Do not execute commands copied from web pages or use the Windows Run dialog or PowerShell when prompted by a page claiming to perform CAPTCHA verification or error resolution.
Keep V3 updated to help block malware infections.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`animecelestialblaze[.]cfd`	Domain observed in September as part of the attack’s distribution infrastructure.
DOMAIN	`ascendpopdownloadtoday[.]monster`	Domain identified as used for intermediate redirects or the final ClickFix page.
DOMAIN	`boltpopsecretbutton[.]monster`	Domain identified as used for intermediate redirects or the final ClickFix page.
DOMAIN	`cartoontalesworld[.]cfd`	Domain observed in September as part of the attack’s distribution infrastructure.
DOMAIN	`dallasbackstage[.]com`	C2 domain used by the backdoor to register infected hosts and receive commands, and to report command results.
DOMAIN	`dreamysamuraisoul[.]cfd`	Domain observed in September as part of the attack’s distribution infrastructure.
DOMAIN	`flinchpoploaderfast[.]monster`	Domain identified as used for intermediate redirects or the final ClickFix page.
DOMAIN	`gemscocl[.]com`	C2 domain identified for LegionLoader’s backdoor malware.
DOMAIN	`gushpopsecretdownload[.]monster`	Domain identified as used for intermediate redirects or the final ClickFix page.
DOMAIN	`hotfootpopfilefast[.]monster`	Domain identified as used for intermediate redirects or the final ClickFix page.
DOMAIN	`jetpopdownloadsecret[.]monster`	Domain identified as used for intermediate redirects or the final ClickFix page.
DOMAIN	`leappoploaderinstantly[.]monster`	Malicious intermediate/download domain used in the PowerShell command to retrieve additional code.
DOMAIN	`pixelrainbowclub[.]cfd`	Domain observed in September as part of the attack’s distribution infrastructure.
DOMAIN	`pourpopclickgetfast[.]monster`	Domain identified as used for intermediate redirects or the final ClickFix page.
DOMAIN	`shadowinjalegend[.]cfd`	Domain observed in September as part of the attack’s distribution infrastructure.
DOMAIN	`socialseoguru[.]com`	Domain temporarily observed in August as part of the attack’s distribution infrastructure.
DOMAIN	`spoutpoploaderfast[.]monster`	Domain identified as used for intermediate redirects or the final ClickFix page.
DOMAIN	`tearpopfilegetfast[.]monster`	Domain identified as used for intermediate redirects or the final ClickFix page.
IPV4	`89[.]34[.]90[.]217`	C2 IP identified for LegionLoader distributed via spear phishing.
MD5	`0128a4b78aab83796042118ecb3e46e0`	MD5 hash listed in the article’s malware IOC section.
MD5	`27745ec8bde201e771e3f4069e887cad`	MD5 hash listed in the article’s malware IOC section.
MD5	`685b6822b0c66f4f18496eb6ce24f984`	MD5 hash listed in the article’s malware IOC section.
MD5	`8467ca57bdf6e6e94ca4e1484628b1aa`	MD5 hash listed in the article’s malware IOC section.
MD5	`c4debc1b25ab67f094676ddc3195fa41`	MD5 hash listed in the article’s malware IOC section.
URL	`hxxp[:]//dallasbackstage[.]com/nback[.]Php`	C2 endpoint used to report command execution results.
URL	`hxxp[:]//dallasbackstage[.]com/nfront[.]Php`	C2 endpoint used to register infected hosts and receive commands.
URL	`hxxp[:]//gemscocl[.]com/nback[.]Php`	C2 endpoint used to report command execution results.
URL	`hxxp[:]//gemscocl[.]com/nfront[.]Php`	C2 endpoint used to register infected hosts and receive commands.