New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile
A new malicious campaign has been discovered targeting users searching for PDF documents online. The attack uses fake CAPTCHAs and CloudFlare Turnstile to deliver LegionLoader malware, which then installs a malicious browser extension. The infection chain involves a drive-by download, execution of a VMware-signed application that sideloads a malicious DLL, and use of process hollowing to inject the LegionLoader payload. The browser extension, disguised as 'Save to Google Drive', is installed on Chrome, Edge, Brave and Opera browsers to steal sensitive user data and monitor Bitcoin activities. The campaign has affected over 140 customers, primarily in North America, Asia and Southern Europe, with technology and financial services sectors being the most targeted.
Pulse ID: 67f0e1fafb3df4665f729a46
Pulse Link: https://otx.alienvault.com/pulse/67f0e1fafb3df4665f729a46
Pulse Author: AlienVault
Created: 2025-04-05 07:55:38
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
