Windows PowerShell Phish Uses Fake CAPTCHA, Downloads Credential Stealer

'Many GitHub users this week received a novel phishing email warning of critical security holes in their code,' reports Krebs on Security — citing an email shared by one of his readers:

'Hey there! We have detected a security vulnerability in your repository. Please contact us at https://github-scanner[.]com to get more information on how to fix this issue....' Clicking the 'I'm not a robot' button generates a pop-up message asking the user to take three sequential steps to prove their humanity. Step 1 involves simultaneously pressing the keyboard key with the Windows icon and the letter 'R,' which opens a Windows 'Run' prompt that will execute any specified program that is already installed on the system.

Step 2 asks the user to press the 'CTRL' key and the letter 'V' at the same time, which pastes malicious code from the site's virtual clipboard. Step 3 — pressing the 'Enter' key — causes Windows to launch a PowerShell command, and then fetch and execute a malicious file from github-scanner[.]com called 'l6e.exe....' According to an analysis at the malware scanning service Virustotal.com, the malicious file downloaded by the pasted text is called Lumma Stealer, and it's designed to snarf any credentials stored on the victim's PC.

Even though this might fool some users, Krebs points out that Microsoft 'strongly advises against nixing PowerShell because some core system processes and tasks may not function properly without it. What's more, doing so requires tinkering with sensitive settings in the Windows registry...'

Thanks to long-time Slashdot reader sinij for sharing the article.

Read more of this story at Slashdot.