The CAPTCHA Trap That Hid Behind Real Websites and a Blockchain C2 Trail

What makes this campaign noteworthy is not just the malware, but the delivery logic behind it. A trusted website can become the front door for a malicious prompt, and a public blockchain can become a fallback map for locating command infrastructure. That combination raises the cost of cleanup and complicates simple blocklists.

Fast Facts

• At least 31 legitimate business websites were reportedly compromised in the campaign.
• Fake CAPTCHA prompts were used as part of the delivery chain.
• The payload delivered was a PowerShell backdoor linked to banking malware.
• Polygon blockchain lookups were used to help locate command-and-control infrastructure.
• The activity was described as ongoing since at least November 2025.

Why the chain matters

The ClickFix pattern works because it shifts execution onto the victim’s machine. Rather than relying only on a file download or a direct exploit, the lure borrows trust from a familiar web interaction, then pushes the user toward running commands. In practice, that means defenders are not just watching for malicious attachments - they are watching for a browser session that turns into script execution.

PowerShell is a particularly useful stage for attackers because it is native to Windows and often present in legitimate administration workflows. MITRE ATT&CK tracks this as PowerShell abuse, and the defensive challenge is familiar: encoded commands, hidden windows, and parent-child process chains can make malicious activity look like routine IT automation unless script telemetry is enabled.

The Polygon element adds a second problem. If malware is using blockchain data to locate C2 servers, defenders may lose the benefit of a single removable address or domain. That does not make the malware invisible, but it can reduce the value of a one-step takedown and force analysts to look for the lookup behavior itself, such as unusual outbound requests to blockchain endpoints or unexpected RPC traffic.

At the time of writing, public information does not fully establish the exact implementation of the blockchain lookup, the complete scope of affected users, or whether data theft occurred. The available information supports a risk analysis, not a definitive claim about all downstream impact.

Defensive lessons

The practical takeaway is straightforward: watch for browser-to-PowerShell execution paths, especially when they begin with a CAPTCHA-like prompt or a page asking the user to copy and paste a command. Security teams should also log script blocks, monitor suspicious PowerShell parents, and review outbound access to blockchain-related endpoints if those services are not business-essential.

For website owners, the incident is a reminder that compromise does not need to be flashy to be dangerous. A trusted page used as a lure can turn ordinary traffic into an infection path, which means patching web applications, enforcing strong authentication, and checking site integrity are not optional maintenance tasks. They are part of the malware defense line.

Conclusion

The deeper lesson is that modern malware is increasingly modular. One layer can live on a compromised site, another can hide in a user prompt, and another can lean on public infrastructure for resilience. For defenders, the answer is not panic - it is visibility across the whole chain, from the browser prompt to the PowerShell console to the outbound network trace.

WIKICROOK

• ClickFix: A social-engineering pattern that pushes a user to run commands through a fake fix, check, or verification step.
• PowerShell backdoor: Malicious PowerShell-based code that can run commands, stage payloads, or maintain access on Windows.
• Command-and-control (C2): The infrastructure malware uses to receive instructions or locate the next stage of an attack.
• Polygon blockchain: A public blockchain platform that can be abused as a durable lookup or rendezvous source.
• Fake CAPTCHA: A fraudulent human-verification prompt designed to trick users into taking a malicious action.