LevelBlue Details ClickFix Campaign Delivering Rotating Stealers Through Fake CAPTCHA Pages

Mar 20, 2026 · Original article ↗

Summary

LevelBlue researchers traced a ClickFix campaign that injects fake CAPTCHA prompts into compromised websites, tricking users into running PowerShell commands that load Donut shellcode and rotating stealers or a crypto clipboard hijacker in memory.

Key points

Researchers identified more than two dozen compromised legitimate websites redirecting visitors to fake CAPTCHA prompts that imitate browser verification.
The prompts place a PowerShell command on the clipboard and instruct users to run it through the Windows Run dialog, launching a staged, largely fileless infection chain.
Analysis traced the chain through PowerShell scripts to Donut shellcode, which executes payloads in memory with minimal disk artifacts.
Observed payloads included StealC, Lumma, a cryptocurrency clipboard hijacker, Vidar, Aura, and Rhadamanthys; live execution showed the infrastructure serving different payloads over time.
The clipboard hijacker monitors for cryptocurrency wallet addresses and silently replaces them with attacker-controlled addresses.
Researchers linked the delivery infrastructure to more than 3,000 cryptocurrency-exchange-themed domains, but said available evidence does not establish whether the template seller was involved in the malware operation.
The report recommends behavior-based monitoring for clipboard-driven command execution, suspicious PowerShell activity, in-memory loaders, and unusual outbound connections.

Article Details

Attack Vectors: Malicious JavaScript injected into compromised legitimate websites loaded attacker-controlled fake CAPTCHA pages.
The fake CAPTCHA instructed users to copy and execute a staged PowerShell command through the Windows Run dialog.
PowerShell downloaded and executed staged scripts in memory, which loaded Donut shellcode and subsequent payloads.
The campaign rotated credential stealers and a cryptocurrency clipboard hijacker through shared delivery infrastructure.
Fake cryptocurrency exchange interfaces were used to harvest credentials alongside malware delivery.
Defensive Notes: Monitor for clipboard-based command execution and suspicious PowerShell activity following use of the Windows Run dialog.
Detect in-memory loaders and unusual outbound HTTP connections following suspicious Run-dialog activity.
Educate users not to paste or execute commands in the Run dialog at the direction of a browser verification prompt.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`agfoodpos[.]com`	Domain hosting an active Vidar C2 endpoint extracted from the malware.
DOMAIN	`alipico[.]com`	Domain hosting an active Vidar C2 endpoint extracted from the malware.
DOMAIN	`captioto[.]com`	Fake CAPTCHA domain identified as active in the campaign.
DOMAIN	`captoolsz[.]com`	Fake CAPTCHA domain identified as active in the campaign.
DOMAIN	`capztoolz[.]com`	Fake CAPTCHA domain identified as active in the campaign.
DOMAIN	`cptoptious[.]com`	Attacker-controlled fake CAPTCHA domain serving clipboard-hijacking content.
DOMAIN	`mushub[.]cfd`	C2 domain configured in an Aura Stealer sample.
DOMAIN	`namzcp[.]org`	Fake CAPTCHA domain identified as active in the campaign.
DOMAIN	`searchservice[.]cfd`	C2 domain configured in an Aura Stealer sample.
DOMAIN	`sodstreams[.]com`	Domain hosting an active Vidar C2 endpoint extracted from the malware.
DOMAIN	`vision-clouds[.]org`	Fake CAPTCHA domain identified as active in the campaign.
DOMAIN	`yago[.]fun`	Domain hosting an active Vidar C2 endpoint extracted from the malware.
IPV4	`158[.]94[.]209[.]33`	Stage-one server that delivered the initial PowerShell dropper.
IPV4	`178[.]16[.]53[.]70`	Stage-two server that supplied the in-memory shellcode loader.
IPV4	`94[.]154[.]35[.]115`	Payload-delivery and C2 server that supplied shellcode and rotating malware payloads.
URL	`hxxps[:]//107[.]150[.]0[.]79/gate2hj45g2kway/lpr307k4[.]ka879`	Rhadamanthys C2 gate URL identified in the malware configuration.