When you purchase through links on our site, we may earn an affiliate commission.Heres how it works.
There, the visitor would be presented with what appeared to be your standard CAPTCHA.
That code triggers a PowerShell script that downloads and runs the Ghostpulse payload.
The malware works by looking at the specific pixels and reading their color to collect information hidden inside.
Ghostpulse is usually used as a loader, deploying more dangerous malware to the compromised systems.
Elastic Security found that most of the time, the crooks use it to deploy the Lumma infostealer.
ViaThe Register
