A suspected state-sponsored Russian group may have developed the 'GammaSteel' attack to help them spy on and steal data from ...

Gamaredon breached a Western military mission on Feb 26, 2025, using upgraded GammaSteel malware and new obfuscation tactics.

Step 3 — pressing the “Enter” key — causes Windows to download and launch malicious code through “mshta.exe,” a Windows program designed to run Microsoft HTML application files.

When solving the malicious CAPTCHA, a hidden mshta.exe command will be copied to the Windows clipboard to perform the "human verification" process. The target is told to perform this verification ...