Amatera Stealer Fake Captcha against MS Teams and What to do.

Reported attacks where users receive a fake CAPTCHA through Microsoft Teams or are redirected from a Teams message to a fake verification screen, this is a phishing and malware technique. Attackers often impersonate IT support, send a Teams chat, and then direct the victim to a fake CAPTCHA page that instructs them to run commands on their computer. The goal is to install malware or steal credentials. 

Key signs of a fake CAPTCHA

• It asks you to press Windows + R, paste text, run PowerShell, or execute commands. Legitimate CAPTCHAs never do this. 
• The message comes from an unexpected Teams user, especially one marked(External). 
• The sender claims to be IT Help Desk and creates urgency.
• The CAPTCHA appears before downloading software or "security tools.

What to do if you encounter one

1. Do not follow any instructions that involve running commands.
2. Close the page or Teams chat.
3. Report the message to your security team.
4. If you already executed the commands:
   • Disconnect the device from the network.
   • Run a security scan.
   • Change passwords from a clean device.
   • Review MFA settings and active sessions.

If you're dealing with a specific Teams message or screenshot, upload it and I can help determine whether it's malicious.

How to prevent.

Microsoft 365 environment, the most effective defense is a combination of Teams hardening, user awareness, endpoint protection, and monitoring. These attacks typically rely on social engineering rather than a technical vulnerability. Attackers impersonate IT staff, use external Teams chats, and trick users into executing commands through fake CAPTCHA pages.

1. Restrict External Teams Access

If your business doesn't require unrestricted external Teams communication:

• Review Teams External Access settings.
• Allow only trusted partner domains.
• Block communication with unknown external tenants where possible.
• Ensure users can clearly see the "(External)" label.

Attackers commonly abuse Teams' external collaboration capabilities to impersonate internal personnel.

2. Train Users on Fake CAPTCHA Indicators

Educate users that a legitimate CAPTCHA:

• Never asks them to press Windows+R.
• Never asks them to paste commands.
• Never asks them to launch PowerShell or Terminal.
• Never asks them to install software.

The fake CAPTCHA technique specifically tricks users into executing malicious commands themselves.

3. Block PowerShell Abuse

As a Sr. Systems Administrator, consider:

• Using AppLocker or Windows Defender Application Control (WDAC).
• Restricting PowerShell for standard users where feasible.
• Enabling PowerShell logging:
  • Module Logging
  • Script Block Logging
  • Transcription Logging
• Monitoring for suspicious PowerShell spawned from Explorer or Run dialog.

Many recent Teams-delivered payloads ultimately rely on PowerShell execution.

4. Strengthen Endpoint Protection

Ensure Microsoft Defender for Endpoint or equivalent EDR is configured to:

• Detect suspicious PowerShell.
• Detect malware downloads from browsers.
• Isolate compromised devices automatically.
• Alert on credential theft activity.

If the user executes the malicious commands, EDR often becomes the last line of defense.

5. Require MFA Everywhere

Use:

• Phishing-resistant MFA when possible (FIDO2, Windows Hello for Business).
• Conditional Access policies.
• Risk-based sign-in controls.

Even if credentials are stolen, MFA significantly reduces attacker success.

6. Monitor for IT Help Desk Impersonation

Create detections for:

• External Teams messages containing keywords such as:
  • Help Desk
  • IT Support
  • Security Team
  • Password Reset
• New external contacts messaging multiple users.
• Teams messages followed by browser downloads.

Fake help desk impersonation is one of the most common Teams phishing techniques being observed.

7. Use Safe Links and Safe Attachments

If licensed for Microsoft Defender for Office 365:

• Enable Safe Links.
• Enable Safe Attachments.
• Enable real-time URL protection.
• Review Teams protection policies.

These controls help prevent users from reaching malicious sites delivered through Teams chats.

8. Incident Response Playbook

If a user reports a fake CAPTCHA:

1. Identify the user.
2. Determine whether commands were executed.
3. Isolate the endpoint if commands were run.
4. Collect PowerShell logs.
5. Reset credentials.
6. Revoke active sessions.
7. Review Entra ID sign-ins.
8. Hunt for similar Teams conversations across the tenant.

Quick Win Checklist

✅ Restrict external Teams access where possible

✅ Train users: "CAPTCHAs never ask you to run commands"

✅ Enable Defender for Endpoint detections

✅ Turn on PowerShell logging

✅ Enforce MFA and Conditional Access

✅ Monitor Teams messages from external users claiming to be IT Support

✅ Have an IR process for reported fake CAPTCHA events

For a Microsoft 365 tenant, I'd prioritize external Teams controls, security awareness training specifically around fake CAPTCHAs, and Defender for Endpoint detections. Those three measures provide the biggest reduction in risk against the current attack patterns.