HelloTDS Malware Spread via FakeCaptcha Infrastructure Infects Millions of Devices

In a Gen Threat Labs, a complex Traffic Direction System (TDS) dubbed “HelloTDS” has been uncovered, orchestrating the delivery of FakeCaptcha and other malicious campaigns to millions of users worldwide.

This elaborate infrastructure employs advanced fingerprinting techniques and social engineering to selectively target victims, infecting over 4.3 million devices in April and May 2025 alone.

The campaign’s reach is staggering, with significant impact observed in the United States, Brazil, India, and Western Europe, while Balkan countries and parts of Africa, including Rwanda, Egypt, Tanzania, and Kenya, face the highest relative risk when adjusted for population and user base.

Sophisticated Traffic Direction System

The HelloTDS network operates by evaluating victims based on geolocation, IP addresses, and browser fingerprints, rejecting connections from VPNs or headless browsers to evade detection.

The attack begins with users visiting compromised or attacker-controlled platforms such as streaming websites, file-sharing services, and torrent mirrors, or through malvertising campaigns.

Sites like dailyuploads[.]net and streamtape[.]to are prime entry points, embedding malicious scripts that initiate contact with HelloTDS endpoints.

The TDS performs a multi-stage fingerprinting process first on the server side using IP and geolocation data, then in the browser by collecting detailed information including window dimensions, WebGL vendor details, battery status, and even sandbox scores to detect virtual environments.

If deemed a suitable target, the system redirects users to malicious landing pages, predominantly FakeCaptcha, which tricks users into executing commands that install information stealers like LummaC2 or remote access trojans (RATs).

Other payloads include fake updates, tech scams, and encrypted malware downloads.

A Multi-Stage Attack Chain

A novel variant of FakeCaptcha further obscures detection by using Unicode math fonts, showcasing the campaign’s evolving stealth tactics.

Intriguingly, HelloTDS dynamically rotates domains with distinctive patterns (e.g., yr[.]unasonoric[.]com) registered under Pananames in Panama, hosted on specific IP ranges under AS7979, and identified by unique HTTP headers like “megageocheckolololo”.

The sophistication of HelloTDS lies in its ability to serve benign content to non-targets, such as security analysts using VPNs, often redirecting them to cryptocurrency investment sites as a decoy or alternative monetization strategy.

Meanwhile, targeted users face a barrage of malicious content designed to exploit trust in familiar CAPTCHA interfaces.

Gen Threat Labs notes that some redirectors mimic legitimate software websites like avs4you.com, blending malicious and benign behaviors to further evade analysis.

This dual nature underscores the importance of robust defenses users are urged to employ real-time security software, enable browser anti-tracking protections, and exercise caution on file-sharing platforms.

Avoiding copy-pasting commands from untrusted sources into system dialogs is critical to preventing self-infection.

Indicators of Compromise (IoCs)

Category	Example IoCs
File Sharing Entry Websites	dailyuploads[.]net, streamtape[.]to, watchadsontape[.]com
HelloTDS Domains	yr[.]unasonoric[.]com, gq[.]binesyorker[.]com, nutatedtriol[.]com
FakeCaptcha Redirectors	actednow[.]com/675cb495c39bc481ddf8edd6, buzzflying[.]shop/6767af2ee2aa535e
FakeCaptcha Landing Pages	adelaidavizcaino[.]com/cpw, finding-from-internet[.]fly[.]storage[.]tigris[.]dev/seacrh-result[.]html

To Upgrade Your Cybersecurity Skills, Take Diamond Membership With 150+ Practical Cybersecurity Courses Online – Enroll Here