Latrodectus from Storm-0249

Summary

Storm-0249, a group Microsoft associates with Latrodectus and other first-stage malware, changed its way in at the start of March 2025. Where it had sent PDFs or links by mail, sometimes themed around copyright complaints, it began taking over legitimate websites — possibly through weaknesses in WordPress — and grafting a lure onto them. A visitor sees the genuine page for a moment before it is swapped for a demand to prove they are human, dressed up as a Cloudflare Turnstile check so the interruption reads as routine. Doing as instructed means pasting a command into the Windows Run dialog. The owners of the hosting sites are victims here, not participants; Microsoft names none of them. The host reached by the pasted command is recorded as cqsf[.]live, seen on 14 May 2025.

Execution mechanisms

The only execution mechanism any published account describes for this campaign is Windows Run dialog (T1204.004), which 23 of the 44 published campaigns in this corpus also record (52%).

Indicators

1 indicator, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.