#captcha — Public Fediverse posts

2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT

A malicious campaign utilizing SmartApeSG ClickFix (also known as BabaDeda) techniques has been observed distributing CNCmachineRMS RAT through fake CAPTCHA verification pages. The attack chain begins with compromised domains serving malicious JavaScript that injects ClickFix text for victims to paste into Windows Run windows. This retrieves an HTA file that subsequently downloads a ZIP archive containing a DLL side-loading package for deploying CNCmachineRMS RAT. The infection establishes command and control communication over TCP port 443 with encoded traffic. The campaign leverages social engineering through fraudulent CAPTCHA pages to trick users into executing malicious code, ultimately leading to RAT installation and persistent access.

Pulse ID: 6af6a2141941c1adfc3963ca
Pulse Link: https://otx.alienvault.com/pulse/6af6a2141941c1adfc3963ca
Pulse Author: AlienVault
Created: 2026-11-13 05:37:24

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clickfix #RAT #SmartApeSg #CAPTCHA #OTX #AlienVault

«Captcha-Alternative — Diese Voice-ID-Lösung soll Bots aussperren:
Statt auf #Captcha, Ausweisfotos oder Videoident setzt das US-Startup Helix auf Stimmproben, um Nutzer:innen vor dem Besuch von #Website's zu verifizieren. Neben dem #Bot-Schutz soll die Voice-ID-Lösung auch eine Alterserkennung ermöglichen.»

Dies geht nicht um die #Sicherheit der User*innen sondern um ihre #Daten für die #KI & Co. Proof-of-Work ( #PoW ) reicht mMn absolut dafür um Bots zu unterbinden.

🤦 https://t3n.de/news/stimmprobe-captcha-bots-1773110/

I just *hate* how #dataDome's #captcha on the #SNCF site (and on #leboncoin, and others) randomly decides to block me despite being logged in with long established accounts, and *after* still doing their "slide this thing". This is on #firefox on #Debian.

Things that didn't work:
* disabling #ublock
* disabling enhanced tracking protection
* VPN + private window

Things that did work:
* using #chromium

WTAF Datadome!?