ATTACKERS ABUSE AI TOOLS TO GENERATE FAKE CAPTCHAS IN PHISHING ATTACKS

Summary from the TLDR InfoSec newsletter

Trend Micro researchers have discovered a new phishing campaign that utilizes Lovable, Netlify, and Vercel to build and host vibe-coded phishing campaigns posing as CAPTCHA pages. The campaigns begin with an email carrying urgent messages such as “Password Reset Required,” which directs the user to a fake CAPTCHA. The fake CAPTCHA then redirects the user to the phishing page, which harvests their credentials. The CAPTCHA pages make the attacks seem more legitimate and filter out security tools.