{
  "name": "How Threat Actors Exploit Human Trust: A Breakdown of the 'Prove You Are Human' Malware Scheme",
  "slug": "how-threat-actors-exploit-human-trust-a-breakdown-of-the-prove-you-are-human-malware-scheme",
  "description": "A malicious campaign exploits user trust through deceptive websites, including spoofed Gitcodes and fake Docusign verification pages. Victims are tricked into running malicious PowerShell scripts on their Windows machines, leading to the installation of NetSupport RAT. The multi-stage attack uses clipboard poisoning and fake CAPTCHAs to deliver the malware. The campaign involves multiple domains, uses ROT13 encoding, and creates persistent infections. Similar techniques were observed in other spoofed content, including Okta and popular media apps. The attack capitalizes on user familiarity with common online interactions, emphasizing the need for vigilance and skepticism in online activities.",
  "published": "2025-06-05T19:19:59+00:00",
  "created_at": "2025-06-05T19:19:59+00:00",
  "modified_at": "2025-06-05T20:00:41+00:00",
  "created_at_opencti": "2025-06-05T19:19:59+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-06-05",
    "captcha",
    "clipboard poisoning",
    "gitcodes",
    "netsupport rat",
    "social engineering"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "194.26.232.180"
      },
      {
        "id": "",
        "name": "95.215.204.156"
      },
      {
        "id": "",
        "name": "91.211.249.44"
      },
      {
        "id": "",
        "name": "185.209.21.241"
      },
      {
        "id": "",
        "name": "212.86.115.52"
      },
      {
        "id": "",
        "name": "tradingviewtradingview.dev"
      },
      {
        "id": "",
        "name": "tradingviewtoolz.com"
      },
      {
        "id": "",
        "name": "tradingviewtool.com"
      },
      {
        "id": "",
        "name": "tradingviewbeta.dev"
      },
      {
        "id": "",
        "name": "tradingviewdev.com"
      },
      {
        "id": "",
        "name": "tradingviewindicator.dev"
      },
      {
        "id": "",
        "name": "tradingview-beta.dev"
      },
      {
        "id": "",
        "name": "tradingviewai.dev"
      },
      {
        "id": "",
        "name": "tradingview-ai.dev"
      },
      {
        "id": "",
        "name": "pastefy.net"
      },
      {
        "id": "",
        "name": "pastefy.pro"
      },
      {
        "id": "",
        "name": "pastefy.com"
      },
      {
        "id": "",
        "name": "pasteco.com"
      },
      {
        "id": "",
        "name": "modedeveloper.com"
      },
      {
        "id": "",
        "name": "modedevs.ai"
      },
      {
        "id": "",
        "name": "modedev.ai"
      },
      {
        "id": "",
        "name": "modedeveloper.ai"
      },
      {
        "id": "",
        "name": "mhousecreative.com"
      },
      {
        "id": "",
        "name": "loyalcompany.net"
      },
      {
        "id": "",
        "name": "hubofnotion.com"
      },
      {
        "id": "",
        "name": "jeffsorsonblog.dev"
      },
      {
        "id": "",
        "name": "givcodes.com"
      },
      {
        "id": "",
        "name": "gitcodes.org"
      },
      {
        "id": "",
        "name": "gitpaste.com"
      },
      {
        "id": "",
        "name": "gitcodes.net"
      },
      {
        "id": "",
        "name": "gitcodes.io"
      },
      {
        "id": "",
        "name": "devtradingview.net"
      },
      {
        "id": "",
        "name": "devtradingview.ai"
      },
      {
        "id": "",
        "name": "devmode-beta.dev"
      },
      {
        "id": "",
        "name": "devmodebeta.dev"
      },
      {
        "id": "",
        "name": "developerbeta.dev"
      },
      {
        "id": "",
        "name": "developer-update.dev"
      },
      {
        "id": "",
        "name": "developer-package.dev"
      },
      {
        "id": "",
        "name": "developer-mode.dev"
      },
      {
        "id": "",
        "name": "developer-beta.dev"
      },
      {
        "id": "",
        "name": "developer-ai.dev"
      },
      {
        "id": "",
        "name": "devchart.ai"
      },
      {
        "id": "",
        "name": "devbetabeta.dev"
      },
      {
        "id": "",
        "name": "dev-update.dev"
      },
      {
        "id": "",
        "name": "dev-beta.com"
      },
      {
        "id": "",
        "name": "codepaste.io"
      },
      {
        "id": "",
        "name": "dans-lupta.xyz"
      },
      {
        "id": "",
        "name": "charts-beta.dev"
      },
      {
        "id": "",
        "name": "betatradingview.dev"
      },
      {
        "id": "",
        "name": "betamodetradingview.dev"
      },
      {
        "id": "",
        "name": "battalia-dansului.com"
      },
      {
        "id": "",
        "name": "batalia-dansului.xyz"
      },
      {
        "id": "",
        "name": "aitradingview.dev"
      },
      {
        "id": "",
        "name": "0xpaste.com"
      },
      {
        "id": "",
        "name": "a8b4797b7e82709d835f1e24a0118e83d76c69be8338e340c7b850c20f07034d"
      },
      {
        "id": "",
        "name": "3acc40334ef86fd0422fb386ca4fb8836c4fa0e722a5fcfa0086b9182127c1d7"
      },
      {
        "id": "",
        "name": "254732635529a0567babf4f78973ad3af5633fd29734ea831e5792292bbf16cd"
      },
      {
        "id": "",
        "name": "f9a241a768397efb4b43924fbd32186fcb1c88716fff3085d3ddcdd322d3404f"
      },
      {
        "id": "",
        "name": "d7fadf7ef45c475bd9a759a771d99ccf95edfa8a0c101ce2439a07b66c2e5c72"
      },
      {
        "id": "",
        "name": "e9fe19455642673b14c77d18a1e7ed925f23906bf11237dfafd7fb2cba1f666d"
      },
      {
        "id": "",
        "name": "c6907acabf2edf0be959c64a434e101963f7c18dcf79f116e0ce6b5ced5dd08c"
      },
      {
        "id": "",
        "name": "b2daa2b5afb389828e088ec8b27c0636bdad94b2ef71dcf8034ee601cb60d8d6"
      },
      {
        "id": "",
        "name": "b258de3b7ef42b4f4bfb0fb5ffe7c55df6aef01cc591abe34a70d1ff82130cd5"
      },
      {
        "id": "",
        "name": "b3e879b5952988fb0c656240365db8f01198f9d83cd2a3ec0e2a8ee172e20a11"
      },
      {
        "id": "",
        "name": "ab8fdde9fb9b88c400c737d460dcbf559648dc2768981bdd68f55e1f98292c2a"
      },
      {
        "id": "",
        "name": "8ffacc942d1c3f45e797369a1f4cbd5dcd84372abf979b06220236d5a5cea649"
      },
      {
        "id": "",
        "name": "89043d2817d1bb4cb57ed939823dca0af9ae412655a6c75c694cb13d088efe5a"
      },
      {
        "id": "",
        "name": "58874c0dc26a78cdc058f84af9967f31b3c43173edc7515fa400e6ef8386205f"
      },
      {
        "id": "",
        "name": "80b274871e5024dfa9e513219fe3df82cc8fe4255010bd5d04d23d5833962c10"
      },
      {
        "id": "",
        "name": "431b0b19239fc5e0eeaee70cd6e807868142e8cd0b2b6b1bd4a7a2cc8eb57d15"
      },
      {
        "id": "",
        "name": "1a128f6748d71d02c72ba51268be181143405830a4e48dfa53bf3d6ed3391211"
      },
      {
        "id": "",
        "name": "07576e1db7e7bd0f7d2c54b6749fdd73c72dba8c2ba8ab110b305cfc10c93c80"
      }
    ],
    "malware": [
      {
        "id": "4b31677e-de15-4b9e-a87a-e6e1c18883d4",
        "name": "NetSupport RAT",
        "slug": "netsupport-rat"
      }
    ],
    "attack_patterns": [
      {
        "id": "de38dd3a-41d7-4621-8a00-a32d7f0ff420",
        "name": "T1102.002"
      },
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      }
    ]
  },
  "external_refs": [
    "https://github.com/DomainTools/SecuritySnacks/blob/main/2025/Prove-You-Are-Human.csv",
    "https://dti.domaintools.com/how-threat-actors-exploit-human-trust",
    "https://otx.alienvault.com/pulse/684209ff0c889eabbed70e8b"
  ]
}