Malware News Supply Chain CAPTCHA Targets Auto Dealerships via Compromised Video Service

[Wrecker4923]

Content source

https://rmceoin.github.io/malware-analysis/2025/03/13/supply-chain.html

Summary:​

Over 100 auto dealerships were being abused compliments of a supply chain attack of a shared video service unique to dealerships. When active, the attack presented dealership visitors with a ClickFix webpage which led to a SectopRAT malware.

Source News Link:​

Supply-chain CAPTCHA attack hits over 100 car dealerships

A security researcher has discovered that the websites of over 100 car dealerships have been compromised in a supply-chain attack that attempted to infect the PCs of internet visitors.

www.bitdefender.com

A security researcher has discovered that the websites of over 100 car dealerships have been compromised in a supply-chain attack that attempted to infect the PCs of internet visitors.

Comment:​

It's not just a questionable website now that will get you with a malware-loaded "CAPTCHA".

 

[Marko :)]

Pretty much all malware today is based on social engineering rather than hacking attacks itself. This one isn't an exception.

Before, you downloaded malicious file, ran it and it was enough for hackers to get access to your PC and your data. Today, hackers literally beg you and need to guide you to run malicious script for them to get access to your PC.
Before, to hack your online account, they just needed to find out your password and e-mail address. Now, they need to trick you into getting them access to your accounts pretending to be from the company itself.

Anyone with a bit of logic in their brain just can't fall on these anymore. Yesterday after a very long time, I got a scam mail sent from my own e-mail address to me. It said they installed Pegasus on all of my devices, took control of cameras and recorded me during sexual activity. Of course they threatened to send videos to all of my contacts if I don't pay 1,350$ to their LiteCoin address.
Too bad they spoofed my e-mail address so I can't reply. I wanted to tell them I won't be paying and that we should check out together if their contacts list is up-to-date. I don't want anyone missing out on such obviously, Hollywood-level, content.