How I Became a Victim of a Social Engineering Attack

Introduction

It’s never easy to admit that you’ve fallen victim to a cyber attack. However, I believe sharing my experience will help others recognize the dangers of social engineering and avoid similar incidents.

How It All Happened

It all started while I was building a private VPN on my VPS and testing it by visiting various websites. During my browsing session, I began encountering numerous human verification CAPTCHA boxes. At first, I assumed this was normal, considering I was visiting random sites and triggering security checks.

While attempting to resolve one of these CAPTCHAs, I was presented with an unusual instruction. Instead of simply checking a box, I was directed to run a command through the Windows Run dialog. The command looked like this:

'I am not a robot: Cloudflare Verification ID: 6RM-42B'

It appeared legitimate at the time, especially since I assumed it was part of a new security measure. Without much thought, I pasted the command and executed it. Unfortunately, that single action handed control of my system to an attacker.

The Realization

I didn’t realize the severity of the incident until today (March 27, 2025). While watching a video by cybersecurity expert John Hammond, I recognized the exact attack I had fallen victim to. It was a classic example of social engineering designed to exploit trust and manipulate users into compromising their own systems.

How This Attack Works

The attacker abused a legitimate Windows utility called mshta.exe. This tool is typically used to run HTML Applications (HTA), but attackers often misuse it to execute malicious scripts.

Step-by-Step Breakdown:

1. Fake CAPTCHA Verification: The attacker displayed a seemingly authentic CAPTCHA verification, creating a false sense of security.
2. Social Engineering: Instead of validating through the usual browser mechanism, the page instructed me to run a command using mshta.exe.
3. Code Execution: When I ran the command, it connected to a malicious domain to download and execute a script.
4. Fileless Attack: Since the payload was executed directly in memory without leaving traces on the disk, it became difficult for antivirus solutions to detect.
5. Payload Deployment: The attacker could deploy various malicious payloads such as:

• Ransomware: Encrypting files and demanding payment.
• Keyloggers: Capturing sensitive information like passwords.
• Remote Access Trojans (RATs): Gaining unauthorized control of the system.

Potential Threats

Once an attacker has control, the consequences can be severe:

• Data Theft: Sensitive data including credentials and financial information can be stolen.
• Ransomware Attack: Attackers may encrypt files and demand a ransom for their release.
• System Manipulation: Remote control via a Command and Control (C2) Server allows the attacker to execute commands and install additional malware.

Mitigation Steps

Here are some effective ways to protect yourself and your organization against such attacks:

1. Block mshta.exe: Disable mshta.exe through Group Policies if it’s not required.
2. Use Web Filtering: Implement an antivirus with web filtering to block access to suspicious or malicious domains.
3. Regular Scanning: Conduct routine system scans using reliable endpoint protection.
4. Employee Awareness: Educate employees about the risks of social engineering attacks and how to identify them.
5. Monitor for Anomalies: Use endpoint detection and response (EDR) solutions to detect unusual activities.

Next Steps

I am currently working on gathering more information about the attacker’s domain. I’ll be documenting my findings and sharing further updates in my upcoming blogs.

Stay safe and stay aware!

If this story resonates with you or you’d like to learn more about cybersecurity, follow my blog for more updates.