Netskope Traces Fake CAPTCHA PDFs to Malware and Scam Funnels

Aug 5, 2026 · Original article ↗

Summary

Netskope traced more than 12,700 similar FakeCaptcha PDFs on Webflow’s CDN to a traffic-distribution network that routes visitors to malware, reseller infrastructure, or scams. Its analysis describes the gate’s filters and more durable detection signals.

Key points

A TLSH fingerprint search found more than 12,700 structurally similar PDFs; a tighter vhash pivot identified about 2,480 files in two clusters analyzed by Netskope, with the earliest submitted in May 2025.
The PDFs pose as upgrade guides and use fake CAPTCHA panels to direct visitors into a traffic-distribution system. Google accounted for about 98% of observed referrers.
The custom Elixir/Phoenix gate applies IP and autonomous-system checks, Cloudflare Turnstile and JWT checks, then geographic and device filtering. Non-qualifying visitors may be sent to search-arbitrage ads.
Netskope observed routing to a Legion Loader distribution hub and a reseller gate. It also found a premium-SMS subscription scam targeting Spanish-speaking users, though the link between that scam and this campaign’s TDS is inferred.
In a previously documented Legion Loader branch, a fake CAPTCHA prompts victims to use Win+R and paste a command to install an MSI. Netskope reports independently confirming routing to that hub through telemetry.
Netskope says the PDF structure and ww80/wwNN router pattern persisted across infrastructure rotation, while lure domains changed over time; it recommends focusing detection on these more stable signals.

Article Details

Attack Vectors: FakeCaptcha PDFs presented in Google search results as ordinary upgrade guides direct users to a traffic-distribution system (TDS).
Clicking the fake CAPTCHA in a PDF sends the visitor to a ww80/wwNN router, which applies IP/ASN, geo, and device filtering before routing qualified traffic.
One branch leads to berapt-medii[.]com, where a fake CAPTCHA reportedly prompts victims to press Win+R and paste a command to install an MSI that drops Legion Loader.
A TDS reseller branch uses yfdpco domains and sk-park[.]php; the article says the destination for qualifying visitors is not pinned.
A premium-SMS scam flow uses a QR-based fake CAPTCHA to route Spanish-speaking users through several pages to a phone-number collection page and an SMS subscription prompt.
Defensive Notes: Netskope recommends detection based on the stable PDF structural fingerprint, the wwNN router subdomain pattern, and rotating lure domains.
The article says blocking Webflow's shared CDN is not practical; it recommends blocking listed malicious domains and infrastructure at the gate rather than merely alerting.
Netskope describes inline signatures for known malicious PDFs, sandbox analysis for patient-zero samples and variants, threat-intelligence blocking for lure and TDS infrastructure, and payload coverage for Legion Loader.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`berapt-medii[.]com`	Legion Loader distribution hub; the article reports fake-CAPTCHA delivery activity at this domain.
DOMAIN	`binonelola[.]com`	Listed as a 2026 lure domain and observed as payload infrastructure contacted by a dropper sample.
DOMAIN	`bovetewa[.]com`	Listed 2026 FakeCaptcha lure domain.
DOMAIN	`chromovira[.]org`	Routing domain in the premium-SMS scam flow, adding another FakeCaptcha step.
DOMAIN	`dutabuz[.]com`	2025 FakeCaptcha lure domain used as front-door infrastructure.
DOMAIN	`godoxevez[.]com`	Listed 2026 FakeCaptcha lure domain.
DOMAIN	`gowixese[.]com`	Listed 2026 FakeCaptcha lure domain.
DOMAIN	`jufewine[.]com`	Listed 2026 FakeCaptcha lure domain.
DOMAIN	`maxudijuz[.]com`	Listed 2026 FakeCaptcha lure domain.
DOMAIN	`nurepikis[.]com`	2026 FakeCaptcha lure domain; also used in the ww19 traffic-router hostname.
DOMAIN	`pofezaf[.]com`	Listed 2026 FakeCaptcha lure domain.
DOMAIN	`riwitamo[.]com`	Listed 2026 FakeCaptcha lure domain.
DOMAIN	`scorenetsystems[.]pro`	Scam landing-page domain used in the premium-SMS subscription flow.
DOMAIN	`solidlinkpro[.]info`	Phone-number-harvesting page in the premium-SMS subscription scam flow.
DOMAIN	`tugoduzak[.]com`	2026 FakeCaptcha lure domain; also used in the ww80 traffic-router hostname.
DOMAIN	`vimemug[.]com`	Listed 2026 FakeCaptcha lure domain.
DOMAIN	`yfdpco1[.]com`	TDS reseller gate domain identified as shared routing infrastructure.
DOMAIN	`yfdpco2[.]com`	Listed as a stage-2 TDS gate domain.
DOMAIN	`yfdpco4[.]com`	TDS reseller gate domain identified as shared routing infrastructure.
DOMAIN	`zuwufag[.]com`	2025 FakeCaptcha lure domain used as front-door infrastructure.
HOSTNAME	`ww19[.]nurepikis[.]com`	Traffic-router hostname used to direct visitors through the TDS.
HOSTNAME	`ww80[.]tugoduzak[.]com`	Traffic-router hostname used to direct visitors through the TDS.
IPV4	`185[.]53[.]179[.]200`	Identified as the IP address of a ww80 traffic router.
IPV4	`188[.]72[.]236[.]249`	Identified as the IP address of the berapt-medii[.]com Legion Loader hub.
IPV4	`208[.]91[.]196[.]46`	Identified as the yfdpco gate backend IP address.
IPV4	`212[.]92[.]104[.]119`	Identified as a TDS entry-gate IP address.
SHA256	`87b8b76762eac941c562c6c8eefb8402f48fc70fcfe360a274b12e75dd5726e2`	Hash of the Documentos[.]pdf.exe dropper sample; the article reports a generic Trojan.Win32.Injuke verdict and describes it as fitting the malware-distribution branch.