New OBSCURE#BAT Malware Uses Fake CAPTCHA Pages To Target Users

The recently discovered OBSCURE#BAT malware campaign represents a sophisticated cyber threat that employs deceptive fake CAPTCHA pages to trick users into downloading malicious files. This new strain, identified by Trend Micro researchers, primarily targets users in the United States while utilizing advanced techniques like rootkits and social engineering to maintain persistence and evade detection.

Key Takeaways:

• OBSCURE#BAT utilizes fake CAPTCHA pages as its primary infection vector
• The malware employs sophisticated rootkit technology for system persistence
• Attackers use PowerShell and batch scripts to deploy additional payloads
• The campaign implements multiple layers of obfuscation to avoid detection
• Data exfiltration occurs through HTTPS connections to attacker-controlled servers

Initial Infection Vector and Attack Chain

The OBSCURE#BAT infection begins with targeted phishing emails containing malicious URLs. When users visit these sites, they encounter fake CAPTCHA verification pages designed to seem legitimate. These pages prompt users to download what appear to be standard executable files, often masquerading as updates for common applications like Chrome or Zoom.

Advanced Persistence and Evasion Mechanisms

Once installed, OBSCURE#BAT demonstrates sophisticated persistence techniques through API hooking and registry modifications. The malware deploys a rootkit that effectively conceals malicious processes from detection. Through timestomping, it modifies file timestamps to appear legitimate and uses DLL search order hijacking to gain elevated privileges on the system.

Data Theft and Command Infrastructure

The primary objective of OBSCURE#BAT is to steal sensitive information from infected systems. The malware systematically collects credentials and system data, transmitting them to command and control servers through encrypted HTTPS connections. To maintain stealth, the attackers implement dynamic DNS services and domain generation algorithms, making tracking and blocking the malicious infrastructure particularly challenging.

Defensive Strategies and Protection

Protecting against OBSCURE#BAT requires a multi-layered security approach. Organizations should focus on email filtering and regular security awareness training to prevent initial infection. Additional essential measures include:

• Implementing current endpoint detection and response tools
• Regular system patching and updates
• Strict application of least privilege principles
• Active monitoring of PowerShell and batch script execution
• Network traffic analysis for suspicious connections