Threat Intel
Eddiestaler: Rust‑Based Infostealer Delivered via Fake CAPTCHA Pages
A new Rust‑compiled infostealer, Eddiestaler, is being distributed through deceptive CAPTCHA interfaces that trick users into running a PowerShell payload. The malware harvests credentials, browser data, and crypto wallet info, and communicates with a C2 server for instructions. Defenders should block suspicious CAPTCHA scripts, monitor for clipboard‑copy PowerShell commands, and enforce script‑execution policies.
What happened
Elastic Security Labs identified a new infostealer, Eddiestaler, written in Rust and distributed through fake CAPTCHA pages on compromised websites. The malicious site presents a "I'm not a robot" prompt that copies a PowerShell command to the clipboard, prompting users to run it manually.
How it works
The attacker hosts an obfuscated React script that renders a CAPTCHA‑like dialog. When the user interacts, the script copies a PowerShell command that downloads a second‑stage payload (gverify.js). This script then connects to a C2 server, receives a task list, and collects data such as Windows credentials, browser history, and cryptocurrency wallet addresses.
Impact
Windows hosts that visit the compromised site and execute the command are infected. The malware can exfiltrate credential caches, browser cookies, and wallet keys, potentially enabling credential reuse and financial theft.
Mitigation
- Block or sandbox URLs that serve suspicious CAPTCHA scripts.
- Enforce PowerShell execution policies to prevent user‑initiated scripts from downloading unknown code.
- Deploy web‑filtering or script‑blocking solutions that detect clipboard‑copy of PowerShell commands.
- Monitor outbound traffic for connections to known C2 domains or unusual PowerShell downloads.
- Educate users to avoid running scripts prompted by CAPTCHA interfaces.
Related articles
Mac Malware Uses Fake CAPTCHA to Steal Keychain Credentials and Drain Crypto Wallets
A Go‑based malware delivered via a ClickFix phishing scam infected macOS systems by executing a terminal command. The payload extracts Keychain passwords and drains cryptocurrency wallets. Defenders should block the malicious domain, update EDR signatures, and audit Keychain access logs.
Read briefing
ClearFake Campaign Uses WebDAV and Fake CAPTCHA Lures to Deploy Amatera Stealer
Cybersecurity researchers have uncovered a new ClearFake infection campaign that leverages fake Google CAPTCHA prompts and WebDAV shares to distribute the Amatera information stealer. The multi-stage attack tricks users into running malicious commands, resulting in the deployment of secondary payloads such as ZigCryptoStealer, a Go-based reverse proxy, and unauthorized instances of NetSupport Manager. Activity targeting a Ukrainian government organization has been linked to a threat cluster tracked as UAT-10820.
Read briefing
Corp MDM Android Spyware Targets Logistics Sector via Fake Google Play Pages
A targeted campaign is distributing Android spyware known as Corp MDM via fraudulent Google Play landing pages impersonating logistics brands. The malware, packaged as a system service, is designed to intercept inbound SMS traffic, manipulate call routing, and maintain persistent background execution using a hard-coded command-and-control infrastructure.
Read briefing
Fake LastPass Installers Deploy Kernel-Driver EDR Killer and Rapuncel Infostealer
A campaign using counterfeit LastPass Authenticator apps has pushed a Microsoft‑attested kernel driver that disables 145 security products and installs the Rapuncel infostealer. The attack leveraged GitHub and Cloudflare to distribute the malicious payload, impersonating at least 40 organizations. Defenders should block the malicious driver, verify kernel modules, and update EDR signatures.
Read briefing