Fake CAPTCHA Malware Steals Credentials via Blockchain Hiding Technique

Cisco Talos has uncovered a sophisticated malware operation that uses fake Google verification prompts and blockchain infrastructure to steal credentials. The malware, called Amatera or ACR Stealer, was first spotted in April 2026 by the Ukrainian government organization.

The attack begins on compromised websites, where a malicious Cloudflare Worker injects ClearFake JavaScript into the page. This script then reaches out to BNB Smart Chain contracts to pull down the next stage of the attack.

Once loaded, the script runs checks to rule out automated browsers and displays a fraudulent Google-style CAPTCHA verification screen. Instead of asking users to click a checkbox, the fake prompt instructs them to press Windows+R, paste content already sitting in their clipboard, and run it.

The pasted command opens a WebDAV path hosted on a randomized subdomain of leaguejazire[.]com and runs a loader file called pf.ch through rundll32.exe. The original 'verification.google' sample used the same WebDAV hosting, filename pattern, and ordinal-based execution method.