Cross-Examining the CAPTCHAgeddon Brought on by ClickFix

Guardio analyzed the ClickFix stealer, an evolved version of fake browser updates. It used fake CAPTCHA pages that enabled it to evade detection and beat popular anti-bot solutions. As a result, it exfiltrated victims’ account credentials and other data from their computers.

The company identified 172 indicators of compromise (IoCs) comprising 156 domains and 16 IP addresses.¹

WhoisXML API analyzed the IoCs further. Our deep dive led to these discoveries:

• 1,156 unique client IPs communicated with 11 unique domain IoCs
• Two alleged victim IPs communicated with three unique IP IoCs
• 30 of the domain IoCs were deemed likely to turn malicious 51–209 days prior to being reported as such

We also expanded the current list of IoCs and uncovered:

• 289 registrant-connected domains
• 193 email-connected domains, one was malicious
• 133 additional IP addresses, 86 were malicious
• 1,037 IP-connected domains, 28 were malicious
• 3,412 string-connected domains, 30 were malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://guard.io/labs/captchageddon-unmasking-the-viral-evolution-of-the-clickfix-browser-based-threat