Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Discovering CAPTCHA Protected Phishing Campaigns

Summary: Unit 42 researchers describe phishing, scam and malware pages that hide their payloads behind legitimate reCAPTCHA challenges or fake CAPTCHA-like validation, so security crawlers see only the challenge and not the malicious content. Using the top 10 most popular malicious CAPTCHA keys over a 30-day period (April 18-May 18), Palo Alto Networks blocked 7,572 unique URLs across 4,088 pay-level domains, with a daily average of 529 new URLs and some keys live for more than 250 days.

What's compelling: Customers attempted to visit those CAPTCHA-protected pages at least 202,872 times in 30 days, and the single lottery grayware page win[.]omgsweeps[.]info accounted for 51% of those visits - while the same URLs were slow to appear in third-party malicious feeds.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related