The attack begins with a fake CAPTCHA verification that instructs victims to manually paste and run a command using the Windows Run dialog.

The attack begins with a fake CAPTCHA verification that instructs victims to manually paste and run a command using the Windows Run dialog.