Phishing

reCAPTCHA Phish – A Dive Into Social Engineering Tactics

This is small harness to recreate the social engineering and phishing lure recently seen in the wild around August/September 2024.

The Lure In The Wild

Originally seen with the guise “Verify you are human”, the attack vector being copy and paste.

It literally instructs the user to open the Windows Run dialog box with the hotkey Win+R, and have them paste in a malicious command with Ctrl+V that the web browser has premptively copied into their clipboard.

Really all you need is index.html. It includes the CSS and JavaScript in a single file for ease of use, but might need further customization to change the command that is ran (see the JavaScript at the end of the showVerifyWindow function).

This can be used as a standalone file and a run any local command, but to get a bit more flexibility with code execution, this repository includes a sample HTA file recaptcha-verify for an innocent proof of concept of popping open the Windows calculator application.

This secondary HTA file would mean it needs to be hosted server-side, or have some other backing infrastructure to offer the payload.

For quick local testing, I literally just used python -m http.server 8000.

The HTA file also gives you an opportunity for more convincing charade, too, potentially with a window that pops up to “try and connect to the reCAPTCHA servers”, but state that it fails and prompt the user to do it all over again. 🤪 (Extra callbacks, anybody?)

So this recreation has some extra perks:

  • Looks and feels like “real” reCAPTCHA (image from the official Google site)
  • Validation in the Run box to “hide” the command (✅ “I am not a robot – reCAPTCHA Verification ID: 7624”)
  • Disabled “Verify” button to further encourage users to complete the copy-paste steps. 🚫
  • Fleshed out phish with the follow-up windows “failed to verify”
  • Clears the clipboard so the payload command is removed.
Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

7 days ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

7 days ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

1 week ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

1 week ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

1 week ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

1 week ago