White lynx uses new “captcha macro” social engineering technique

Intel Name: White lynx uses new “captcha macro” social engineering technique

Date of Scan: December 10, 2025

Impact: High

Summary:
We identified a new social-engineering tactic employed by the Belarusian threat actor White Lynx (also known as Ghostwriter, Storm-0257, UNC1151). The method relies on a malicious macro embedded in a Word document designed to evade detection and analysis. Once macros are enabled, the user is presented with a fake CAPTCHA window prompting them to validate a six-character string. This added step introduces a layer of human interaction before the macro will execute. After the CAPTCHA is completed, the document displays decoy content while carrying out malicious activity in the background.

More Details