Threat Research

The attack chain begins with a malicious script injected into legitimate but compromised websites. This script redirects users to a fake CAPTCHA page designed to mimic a "verify you are human" check. The deceptive CAPTCHA page performs clipboard hijacking—also known as pastejacking—by injecting malicious code into the user's clipboard....

A stealthy web campaign is hijacking users' clipboards to trick them into executing MSI files tied to Legion Loader malware. These MSI files are disguised as "Klio Verfair Tools," a known alias for Legion Loader. The technique, known as "pastejacking" or "clipboard hijacking," instructs users to paste malicious content into the Run window....