Campaign record
Ricardo marketplace lure in German
Ricardo marketplace impersonation targeting Swiss recipients in German
- Status as last assessed
- Active
- First seen
- 2024-09-25
- Last seen
- 2024-09-25
- Indicators
- 6
- Sources
- 1
- Targets
- Windows
- Fake CAPTCHA verification
- Online marketplace impersonation
- AsyncRAT
- PureLog Stealer
- Link in email
Original research
- Proofpoint2024-11-14Vendor researchFirst account
Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape
This page summarises and structures that research; it is not a substitute for the original.
Researchers: if anything here misrepresents your work, email corrections@clickfixreport.com — we correct within 5 working days, no questions asked.
Summary
A German-language mailing aimed at organisations in Switzerland, with indicators dated 25 September 2024. The messages posed as Ricardo, a marketplace familiar to Swiss consumers, and carried links to a landing page built from the public fake-CAPTCHA kit. The page told the reader to click, copy and paste in order to clear a supposed problem; behind that, script code pulled a ZIP archive from a Dropbox share, then a clipboard routine handed PowerShell the job of unpacking it and starting the batch file inside. Proofpoint was not able to recover the final malware at the time, but inferred from the control traffic that AsyncRAT or PureLog Stealer was the likely end of the chain. Published indicators cover the landing-page URL on an .es host, the Dropbox download link, one control address and two file hashes.
Overlap with other campaigns
We compared the 6 indicators in this record — covering 2 distinct registrable domains — against the 43 other published campaigns in this corpus.
ModeloRAT via a fake CrashFix popup
2026-08-29No indicator is shared, but the two records use the same registrable domains.
Shared registrable domain (1)
- domain, shown defanged for safety: dropbox dot com
A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.
Execution mechanisms
The only execution mechanism any published account describes for this campaign is Windows Run dialog (T1204.004), which 23 of the 44 published campaigns in this corpus also record (52%).
Indicators
6 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.
“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.
Not on this record
This record does not yet carry a second publisher's account or our own re-checks of these indicators. Each appears on this page as its own section once it exists; none of it is inferred.
Cite as
ClickFixReport, “Ricardo marketplace lure in German”, campaign ID bd2a1de1, retrieved 2026-08-07, snapshot fb0eed7.
https://clickfixreport.com/campaigns/bd2a1de1/ricardo-marketplace-clickfix
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.