
**A troubling new malware campaign uses fake CAPTCHA pages to deploy the elusive rootkit r77, evading detection and compromising systems.**

**Key Points:**

- Malware uses social engineering tactics and fake CAPTCHA to deliver rootkit.
- Targets English-speaking users, primarily in the U.S., Canada, Germany, and the UK.
- Employs advanced stealth techniques to remain undetected and persists through system reboots.

The OBSCURE#BAT malware campaign is causing concern among cybersecurity experts due to its unique method of infiltration, combining social engineering with a deceptive CAPTCHA verification page. This innovative approach allows attackers to spread a sophisticated rootkit known as r77, which can hide its presence and maintain persistence on infected systems. Initially, users are tricked into executing obfuscated batch scripts that launch malicious PowerShell commands, putting their systems at serious risk without their knowledge. The campaign cunningly targets English-speaking users, which suggests a focused strategy by threat actors to maximize impact.

Once installed, the r77 rootkit can cloak files, processes, and registry keys, enabling it to operate undetected. The malware not only modifies system registry settings to embed itself further but also utilizes advanced techniques, such as regular expression filtering and evasion tactics to bypass traditional antivirus solutions. Its ability to monitor clipboard activity and command history adds another layer of risk, as confidential data could potentially be exfiltrated. As security measures evolve, these attacks highlight the need for continuous vigilance in the face of increasingly sophisticated cyber threats.

How can individuals better protect themselves from deceptive malware campaigns like OBSCURE#BAT?

**Learn More:** [The Hacker News](https://thehackernews.com/2025/03/obscurebat-malware-uses-fake-captcha.html)

**Want to stay updated on the latest cyber threats?** 

 👉 **[Subscribe to /r/PwnHub](https://www.reddit.com/r/pwnhub)**