This report expands LevelBlue’s ongoing investigation into a multi-stage fileless malware campaign in which a network of compromised legitimate websites redirects victims to fake CAPTCHA verification pages delivering credential-stealing payloads through a ClickFix social engineering mechanism.

This analysis examines a complete attack chain targeting Windows systems through social engineering using fake CAPTCHA verification pages to trick users into executing PowerShell commands.