2025-05-19Trend Micro
Fake CAPTCHA Attacks Deploy Infostealers and RATs in a Multistage Payload Chain
Read the original ↗: Fake CAPTCHA Attacks Deploy Infostealers and RATs in a Multistage Payload ChainRetrieved 2026-08-07
Publisher
Trend Micro
www.trendmicro.com/en_us/research.html ↗Vendor research
- Reports structured
- 1
- Campaign records
- 4
- Indicators credited
- 25
- First report
- 2025-05-19
- Latest report
- 2025-05-19
Original research
One report published by Trend Micro is the basis for 4 published campaign records and for 25 indicators in the record. Every one of those pages names them and links their original above the fold.
- The links to their articles are ordinary dofollow links. No nofollow, no ugc, no redirect hop. We are a derivative work built on their research and the link is the payment.
- None of their prose is reproduced. Summaries on this site are composed from extracted fields in our own words; quotations run under 25 words and are attributed inline.
- Every indicator credited to a report of theirs was matched, character for character, against the archived copy of that report before it could be stored. That is a database constraint, not a review step.
These pages summarise and structure that research; they are not a substitute for the originals.
Reports we have structured
1 report
Records built on their reporting
4 records
AsyncRAT and XWorm on one host
Status as last assessed: ActiveID 4d857e92Published 2026-08-07First seen —1 report from Trend Micromshta lures fetching remote HTAs
Status as last assessed: ActiveID c0b21902Published 2026-08-07First seen —1 report from Trend MicroHotel lost-property phishing mail
Status as last assessed: ActiveID 0bd90ac4Published 2026-08-07First seen —1 report from Trend MicroEmmenhtal Loader inside an MP3
Status as last assessed: ActiveID deeaf6a4Published 2026-08-07First seen —1 report from Trend Micro
For Trend Micro
If anything on this page or on the records above misrepresents your work, attributes something to you that you did not publish, or you would rather not be listed at all, email corrections@clickfixreport.com. We correct within 5 working days, no questions asked, and removal is a request rather than a negotiation. Corrections are logged publicly with what changed and when.