ClickFix in action: how fake captcha can encrypt an entire company
Essential information
- Published
- 19/02/2026 15:26
- Modified
- 19/02/2026 18:13
- Tags
- 2026-02-19 c2 communication clickfix fake captcha latrodectus malware analysis persistence ransomware side-loading supper
- Related entities
- 17 observables, 2 techniques (mitre), 2 malware, 5 others
Description
The report details a malware attack on a large Polish organization involving fake CAPTCHA techniques. It describes the initial infection vector, where users were tricked into running malicious code through a Windows+R shortcut. The analysis covers two main malware families: Latrodectus (version 2.3) and Supper. The report provides technical details on the malware's functionality, communication protocols, and persistence mechanisms. It also includes indicators of compromise, such as C2 server IP addresses and file hashes. The authors emphasize the importance of employee education and monitoring for unusual events to mitigate such threats.