Unfortunately, I don’t have much time to dive deeply into this right now, but off the top of my head, this looks like a sophisticated attack leveraging mshta(.)exe to execute malicious code outside the browser sandbox.

The fake CAPTCHA trick is clever, as it uses social engineering to get users to run a command that fetches a second-stage payload.

The obfuscated JavaScript on the site is constructing and executing the payload dynamically using eval(). The use of Ethereum smart contracts for storing or distributing C2 server addresses is particularly notable—there is a growing trend in malware campaigns to leverage blockchain technology for resilience, as blockchain-based infrastructure is much harder to disrupt.

To figure out what the stage 2 payload does, you’d need to:

1. Capture the payload: Use a network proxy or sandbox to intercept the HTTP request made by mshta(.)exe and retrieve the payload.

2. Deobfuscate the JavaScript: Tools like jsbeautifier can help reveal how the payload is constructed.

3. Analyze the payload: Static and dynamic analysis in a controlled environment should provide insight into its behavior.

Blocking mshta(.)exe via group policies is a good mitigation step if it’s not required in your environment. Again, I’m swamped at the moment, but I hope this helps as a starting point. Let me know what you find out.

nostr:npub1qdjn8j4gwgmkj3k5un775nq6q3q7mguv5tvajstmkdsqdja2havq03fqm7 have you seen this? 👀

UPDATE:

The malicious payload seems to be Lumma Stealer that doesn't establish persistence on the victim's machine. Only affects Windows users.