// the find
JohnHammond/recaptcha-phish
Phishing with a fake reCAPTCHA
A single-file HTML/JS/HTA proof-of-concept that recreates the 'ClickFix' phishing lure used in real LummaStealer campaigns — a fake reCAPTCHA page that tricks a user into pasting an attacker-supplied command into the Windows Run dialog. Built by a security researcher to document and reproduce a technique seen in the wild, not a general-purpose dev tool; useful for red teamers, phishing-awareness trainers, and malware researchers who need a disposable lure to study or demonstrate the technique, not for building anything production-facing.
The CSS/JS faithfully mimics Google's real reCAPTCHA widget, down to disabling the 'Verify' button until the clipboard step completes, which is the actual social-engineering hook that makes the original attack work. The HTA variant demonstrates how a 'connection failed, try again' follow-up screen extends the pretext and buys a second clipboard write. It clears the clipboard after the payload is copied, which is a detail most hastily-cloned PoCs skip and that materially affects how convincing (and how forensically quiet) the lure is.
The author states outright the code is sloppy ('the code is bad because I am a bad programmer') — there's no structure, no comments, and the payload command is hardcoded inline in the JS rather than parameterized, so adapting it means hand-editing minified-looking markup. No server-side component for the HTA path; you have to stand up your own hosting and wire the delivery infrastructure yourself. There are no tests, no LICENSE file, and no guardrails against misuse (no watermarking, no sandbox detection) beyond relying on the reader's judgment — this is a raw lure template, not a packaged training/simulation tool, and it hasn't been touched since the September 2024 release.