According to the firm, cybercriminal syndicate Chimborazo is distributing a rigged Excel document capable of infecting victims with the password-stealing GraceWire trojan. Before the Excel file is downloaded, however, the victim is asked to fill out a CAPTCHA form, used in legitimate scenarios to establish whether a user is human or not.
By concealing malware behind a CAPTCHA wall, which in essence requires the user to activate the download manually, hackers are more likely to successfully bypass security systems that scan for automated malware downloads.
- These are our picks of the best ransomware protection services around
- We've built a list of the best productivity tools on the market
- Check out our list of the best business laptops out there
Microsoft Excel malware
Microsoft Security Intelligence has reportedly been tracking the work of Chimborazo at least since January, and has dubbed the ongoing Excel malware campaign Dudear.
“CHIMBORAZO, the group behind Dudear campaigns that deploy the info-stealing Trojan GraceWire, evolved their methods once again in constant pursuit of detection evasion,” the team tweeted. “The group is now using websites with CAPTCHA to avoid automated analysis.”
The group has also been seen to distribute the infected Excel file via phishing campaigns and embedded web links. In a number of recent scenarios, phishing emails link out to redirector sites or contain malicious HTML attachments. In all instances, Chimboranza leaned on the CAPTCHA technique to minimize the risk of detection.
While using CAPTCHA to evade security software is not unheard of, neither is it common - and the technique is fast becoming this particular hacking group’s modus operandi.
Chimboranza is expected to continue to adapt its method of malware delivery in the coming months in a bid to maximize infection rates and head off measures put in place by security teams. For this reason, users are advised to exercise caution when downloading unsolicited Excel files - or files of any other type - and to examine CAPTCHA widgets for signs of illegitimacy.
- Check out our list of the best malware removal services available
Via Ars Technica
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Joel Khalili is the News and Features Editor at TechRadar Pro, covering cybersecurity, data privacy, cloud, AI, blockchain, internet infrastructure, 5G, data storage and computing. He's responsible for curating our news content, as well as commissioning and producing features on the technologies that are transforming the way the world does business.