Hackers Exploit Fake reCAPTCHA Pop-Ups to Steal Crypto Wallet Data

Cybersecurity firm eSentire has uncovered a sophisticated malware campaign targeting cryptocurrency users through deceptive reCAPTCHA-style pop-ups. The operation, dubbed ClickFix, tricks victims into manually executing malicious commands via Windows Run prompts under the guise of security verification.

Threat actors are deploying Amatera Stealer to harvest credentials and NETSupport RAT for remote system access—repurposing legitimate tools for criminal activity. The attack vector begins with counterfeit Cloudflare Turnstile pages and fake security check interfaces that prompt users to "fix" nonexistent issues.

This development underscores growing security risks in the digital asset space as cybercriminals increasingly target crypto holders through social engineering tactics. The campaign represents an evolution of credential-harvesting techniques, with particular implications for users storing keys in browser-based wallets.