---
title: "Detecting Fake CAPTCHA Campaigns: ClickFix, ClearFake, and Etherhide"
description: Discover how cybercriminals trick users with fake CAPTCHA pages to deploy malware and learn effective detection techniques to safeguard your systems against these evolving threats.
image: https://lh7-rt.googleusercontent.com/docsz/AD_4nXeW69xYV76noKIoEINH4kvPDmbgP6e7j04ADFiDK86pGOWhv2ohs5axw1UKUbSx0kAAi5tBFdXx3dZCDlwmQ8KzkOXXco3_PDO6wwPchLVJ3Qs_niXBJiaT_2fV_Z78rkNkDBaCxTwf_AXfbjctdmIQuS7AstOCg5OVUD-UpYAsNyrniGhBav9CgCHay4JOaOQKUDTwg_rknQ00zk9jGZJKhn35qod2EzA59VVRzm9hTYaL3NoiWWC6bJqybWl_r7dAwU8kyaEHt5Aya3zQxohHk0WecM_SVJsS4G0f5QINvmVkMGnjGl2qY4KK1deVFp-SP_iICGNhHucO46JTB2XCp3pAMVhu_At6QwVviqB8EbH1O8D9U_-BHN6dxzNheCtDYcXWdfKmeISbvTjlA1QNPvLE_sQI9YnYR3f0XafkFkt44WpaSZ-nY1bgbJmk5bZM_hp_ANCxJUNWMHEtOPB33Hnf0yGVth0wLU3uAtROWPNSlem_yD6H7kWbxwJb8A8JiNoYisUf9wovX62HmJoRQ39EnwWxuvoBBbFz6U8K87yA7TjQygcPXQqUsxrN1Xjjrsztrp7ez74pbT9FuHRJDbUNLGjb5bxvCTtzwsQdQPh0FeBpkbQtUwpMUdxieY2KGQeMCWP9gwKG6NCnCVP1btJo_fXHqeR9oPhXjE2OSay43iLGmNbIxGlUOPi_1rSMibFBm4TqTA-VMt7GoHWzXYLnkoEEhNo9vugjabBadO3zNH9Bi-HlgLBRu-X4wv2YDICMMg?key=C5r-hWfsZKIZg3ES3b905dmx
---

[Skip to content](https://blog.reconinfosec.com/detecting-fake-captcha-campaigns#main-content)

[![recon_infosec.png](https://blog.reconinfosec.com/hs-fs/hubfs/recon-logo-full-on-white.png?width=7680&height=2304&name=recon-logo-full-on-white.png "recon_infosec.png")](http://reconinfosec.com)

- [Website Home](https://www.reconinfosec.com/)

- [Website Home](https://www.reconinfosec.com/)

# Detecting Fake CAPTCHA Campaigns: ClickFix, ClearFake, and Etherhide

[Luke Rusten](https://blog.reconinfosec.com/author/luke-rusten)

Our team recently observed a significant uptick in malware campaigns leveraging **fake CAPTCHA pages** to deploy info-stealers, loaders and remote access trojans (RATs). These lures are part of evolving social engineering chains that culminate in the delivery of threats like **Lumma Stealer**, **Sliver**, and **Emmenhtal**.

Some variants including **ClickFix** and **ClearFake**, which utilize a novel technique known as **Etherhiding,** demonstrate how threat actors are innovating in their use of obfuscation, blockchain infrastructure, and clipboard-based payload execution. This post offers a brief technical breakdown of these campaigns and focuses on **behavioral detection opportunities** relevant to defenders.

## Threat Overview

These fake CAPTCHA pages are often part of **malvertising chains** or **SEO poisoning tactics** designed to lure users searching for specific types of content. Some common examples were from users searching for:

**ClickFix:**

- **Free/Pirated Movies**: Torrent sites, streaming mirrors, or forums linking to "free" content often serve as initial redirectors.
- **Manuals or Technical Documentation**: Especially obscure or niche product manuals, user guides, and troubleshooting PDFs. These are frequently SEO-optimized to rank high in Google searches.
- **Travel Booking and Reservations**: Sites mimicking airlines, hotels, or booking confirmations that ask the user to "verify they’re human" before showing blurred booking details.
- **Storage and Shipping Service:** Mimicked storage or courier service platforms.

**ClearFake + Etherhiding:**

- **Infected WordPress websites**: Cases of ClearFake typically involve legitimate WordPress websites that have been infected with malicious JavaScript.

**The fake CAPTCHA pages are convincingly designed and typically include:**

- A blurred document or video frame behind a CAPTCHA widget.
- Phrases like "Click to verify you're human" or “Complete these Verification Steps.”
- Often hosted on recently registered domains with names that mimic legitimate services or tech brands.
- Sometimes embedded in PDFs or accessed via shortened links in phishing emails.

![verification](https://blog.reconinfosec.com/hs-fs/hubfs/verification.png?width=573&height=509&name=verification.png)

An example of a malicious CAPTCHA

## Campaign Architecture

### **1. JavaScript-Based Delivery (ClearFake/ClickFix)**

Malicious JavaScript is embedded in compromised sites:

- Encoded using Base64
- Windows OS detection before CAPTCHA render
- Obfuscation via multiple techniques such as:  
    - Indirect function calls
    - Arithmetic decoding
    - Random variable names
    - Hex-based string reconstruction

![domain](https://blog.reconinfosec.com/hs-fs/hubfs/domain.png?width=624&height=49&name=domain.png)

JavaScript embedded in Wordpress site (ClearFake)

![obfuscated](https://blog.reconinfosec.com/hs-fs/hubfs/obfuscated.png?width=624&height=119&name=obfuscated.png)

Script embedded in HTML that is obfuscated with phpkobo html obfuscator. (ClickFix)

### **2. Blockchain-Based Payload Hosting (Etherhiding)**

**ClearFake** variants now embed payload references directly in **Binance Smart Chain (BSC)** contracts:

- PowerShell/MSHTA command embedded in BSC smart contract
- Webpage fetches and auto-copies payload to clipboard
- The same contract address observed in multiple cases from this [Atea Report](https://www.atea.no/siste-nytt/it-sikkerhet/investigating-a-clearfake-clickfix-etherhide-campaign/)

## Exploitation Techniques

### Command Execution: ClickFix abuses the Windows clipboard to trick the user into executing commands:

- Payload auto-copied to clipboard
- User instructed to paste into the Run dialog using **Win + R**
- Delivered command executes MSHTA or PowerShell

### **The Payload:** The command payload is disguised to look like a CAPTCHA verification, often using the legitimate mshta.exe binary:

- In many cases the attack uses **homoglyphs**—characters that look legit but evade static detection.
- There are no html file extensions being executed in the command which is likely another attempt to evade detection.
- In every case **Explorer.exe** is the parent when using the Window Run dialogue box (This can be advantageous in detection writing).

![homoglyphs1](https://blog.reconinfosec.com/hs-fs/hubfs/homoglyphs1.png?width=494&height=257&name=homoglyphs1.png)

MSHTA command that is utilizing homoglyphs

![homoglyphs2](https://blog.reconinfosec.com/hs-fs/hubfs/homoglyphs2.png?width=498&height=301&name=homoglyphs2.png)

MSHTA command that is utilizing homoglyphs

![homoglphys3](https://blog.reconinfosec.com/hs-fs/hubfs/homoglphys3.png?width=523&height=289&name=homoglphys3.png)

MSHTA command that is not utilizing homoglyphs

### Obfuscated PowerShell Download Cradles

The script creates a WebClient object and uses fuzzy logic to identify the method used for downloading content—DownloadString—without referencing it by name. It does this by calling Get-Member to list available methods on the object, then filters them using the -clike operator (case-insensitive wildcard match) to find something resembling “\*wn\*g” (matching “DownloadString”).

This approach helps evade static detection by avoiding hardcoded method names and relying on dynamic discovery instead. Ultimately, it builds a download cradle that fetches and executes a remote payload in memory, without writing anything to disk.

![get-member](https://blog.reconinfosec.com/hs-fs/hubfs/get-member.png?width=475&height=360&name=get-member.png)

Variant using Get-Member and 13,36,48 to utilize Invoke-Expression

Another interesting variation using the same technique, but using a slightly different way of running Get-Member and execution parameters of the encoded PowerShell. Finding the similarities between each variant will be helpful for building detections.

![invokescript](https://blog.reconinfosec.com/hs-fs/hubfs/invokescript.png?width=459&height=373&name=invokescript.png)

Variant using InvokeScript and GM for Get-Member

One more variation where PowerShell uses the -like function to call DownloadString without case sensitive matching. You can also spot multiple interesting ways the script calls Invoke-Expression (or InvokeScript) in these events. All of which are spawned from Base64 encoded PowerShell commands (which is important for detection opportunities later).

![like-variant](https://blog.reconinfosec.com/hs-fs/hubfs/like-variant.png?width=459&height=360&name=like-variant.png)

Variant using -like command and Invoke-Expression via fuzzy match

### AMSI Bypass Technique Modifying CLR.DLL in Memory

Some variants dynamically disable [AMSI](https://practicalsecurityanalytics.com/new-amsi-bypss-technique-modifying-clr-dll-in-memory/):

- Builds byte signature for AmsiScanBuffer
- Locates and modifies clr.dll in memory
- Effectively disables AV scanning of PowerShell scripts

![amsi](https://blog.reconinfosec.com/hs-fs/hubfs/amsi.png?width=476&height=506&name=amsi.png)

Snippet of PowerShell used to bypass AMSI via CLR.DLL

## Post-Exploitation Behavior

Across all variants, there was consistent use of one or more of the following:

- **Info Stealers (Lumma, Vidar, etc)**: Credential theft, session tokens, browser data, crypto wallets
- **Remote Browser Debugging**: PowerShell initiating debug mode on Edge/Chrome
- **Sliver RAT**: Open-source C2 framework for persistent access
- **Loaders**: Including **Emmenthal**, with others reported in the wild
- **RunOnce Persistence**: Lengthy binaries (≥26 characters) creating **RunOnce** keys with known **Lumma Stealer**

### **Remote Browser Debugging**:

Many samples initiate **remote debugging sessions** on all installed browsers. This allows them to extract cookies, session tokens, and other sensitive artifacts without triggering typical browser protections.

![edge](https://blog.reconinfosec.com/hs-fs/hubfs/edge.png?width=484&height=258&name=edge.png)

PowerShell running remote debugging on port 9200 for Microsoft Edge

![chrome](https://blog.reconinfosec.com/hs-fs/hubfs/chrome.png?width=493&height=267&name=chrome.png)

PowerShell running remote debugging on port 9203 for Google Chrome

### Execution of Lumma Stealer via RunOnce key

In a couple of instances we observed very lengthy executables creating **RunOnce** registry keys for executables that have been identified as **Lumma Stealer**. The character length does appear to vary, but this does create a detection opportunity for us as well as it does appear to be over 26 characters in length which should be rare.

![runonce1](https://blog.reconinfosec.com/hs-fs/hubfs/runonce1.png?width=494&height=282&name=runonce1.png)

RunOnce registry key added by 26 character ParentImage

![runonce2](https://blog.reconinfosec.com/hs-fs/hubfs/runonce2.png?width=494&height=284&name=runonce2.png)

RunOnce registry key added by 28 character ParentImage

## Detection & Hunting Opportunities

While these techniques leverage some sneaky tactics and heavy obfuscation there are several detection opportunities. Below are some useful Sigma rules that can be used for detection and hunting (you can convert some of these to queries using something like uncoder.io for validation and tuning). Each rule should be carefully evaluated and assigned a threat level based on your validation process.  All of these detections were written based on this campaign, but when writing detections we always want to consider writing the detection in such a way that we may detect similar threats and variants. If we make them too specific we risk missing things when campaigns shift tactics. As we have seen with some of the examples above, threat actors are doing it frequently.

### **Homoglyph Social Engineering**

The following Sigma rule detects the use of homoglyphs in conjunction with highly suspicious binaries. It is unlikely to have many false positives in regions that do not frequently use Cyrillic text. This rule eliminates some of the false positives from the Sigma project's [Potential Homoglyph Attack Using Lookalike Characters](https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml) by pairing it with often-abused binaries.

```
title: Homoglyph Attack Using Lookalike Characters Used With Highly Suspicious Binaryid: 2bd01836-ab65-4897-b3f9-9981e7c04394status: experimentaldescription: Detects homoglyphs being used with highly suspicious binaries.references:   - https://www.joesandbox.com/analysis/search?threatname=clickfix   - http://www.irongeek.com/homoglyph-attack-generator.phpauthor: Luke Rustendate: 2025/04/07tags:   - attack.defense_evasion   - attack.t1036   - attack.t1036.003logsource:   category: process_creation   product: windowsdetection:   suspicious_binary:       CommandLine|contains:           - 'powershell'           - 'cmd'           - 'wscript'           - 'cscript'           - 'mshta'           - 'rundll32'           - 'regsvr32'           - 'wmic'           - 'schtasks'           - 'certutil'           - 'msiexec'           - 'bitsadmin'   selection_upper:       CommandLine|contains:           - "\u0410" # А/A           - "\u0412" # В/B           - "\u0415" # Е/E           - "\u041a" # К/K           - "\u041c" # М/M           - "\u041d" # Н/H           - "\u041e" # О/O           - "\u0420" # Р/P           - "\u0421" # С/C           - "\u0422" # Т/T           - "\u0425" # Х/X           - "\u0405" # Ѕ/S           - "\u0406" # І/I           - "\u0408" # Ј/J           - "\u04ae" # Ү/Y           - "\u04c0" # Ӏ/I           - "\u050C" # Ԍ/G           - "\u051a" # Ԛ/Q           - "\u051c" # Ԝ/W           - "\u0391" # Α/A           - "\u0392" # Β/B           - "\u0395" # Ε/E           - "\u0396" # Ζ/Z           - "\u0397" # Η/H           - "\u0399" # Ι/I           - "\u039a" # Κ/K           - "\u039c" # Μ/M           - "\u039d" # Ν/N           - "\u039f" # Ο/O           - "\u03a1" # Ρ/P           - "\u03a4" # Τ/T           - "\u03a5" # Υ/Y           - "\u03a7" # Χ/X   selection_lower:       CommandLine|contains:           - "\u0430" # а/a           - "\u0435" # е/e           - "\u043e" # о/o           - "\u0440" # р/p           - "\u0441" # с/c           - "\u0445" # х/x           - "\u0455" # ѕ/s           - "\u0456" # і/i           - "\u04cf" # ӏ/l           - "\u0458" # ј/j           - "\u04bb" # һ/h           - "\u0501" # ԁ/d           - "\u051b" # ԛ/q           - "\u051d" # ԝ/w           - "\u03bf" # ο/o   condition: suspicious_binary and (1 of selection_*)falsepositives:   - Commandlines with legitimate Cyrillic text; will likely require tuning (or not be usable) in countries where these alphabets are in use.
```

---

### **MSHTA/PowerShell**

The following Sigma rule detects Mshta.exe getting launched with Explorer as the parent and no HTML file specified which is highly suspicious. In addition, the Sigma project's [Remotely Hosted HTA File Executed Via Mshta.EXE](https://blog.reconinfosec.com/detecting-fake-captcha-campaigns/%20%C2%A0https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_http.yml)will detect mshta.exe reaching out over common internet protocols (http, https, or ftp).

title: Highly Suspicious MSHTA.exe Execution From Explorer Parent  
id: 5fa3b3df-7bed-4bea-b144-22d7b8f59af1  
status: experimental  
description: Detects MSHTA.exe being launched from explorer without specifying an html file which is highly unusual  
references:  
   - https://www.joesandbox.com/analysis/search?threatname=clickfix  
tags:  
   - attack.execution  
   - attack.defense\_evasion  
   - attack.t1218.005  
author: Luke Rusten  
date: 2025/04/10  
logsource:  
   category: process\_creation  
   product: windows  
detection:  
   selection:  
       Image|endswith: '\\mshta.exe'  
       ParentImage|endswith: '\\explorer.exe'  
   filter:  
       CommandLine|contains:  
         - '.hta'  
         - '.htm'  
   condition: selection and not filter  
falsepositives:  
   - Unknown  
level: low

---

### **PowerShell Download Cradles**

Our PowerShell Webclient With Get-Member Matching Launched From Encoded PowerShell detection is great to start off as a threat hunt in your environment to develop a baseline and start to tune. You will not likely find many encoded PowerShell scripts running this combination of commands if at all.

title: PowerShell Webclient With Get-Member Matching Launched From Encoded PowerShell  
id: 5068d424-4d35-412f-aa8b-9a49bf8183dd  
status: experimental  
description: PowerShell Webclient With Get-Member Matching Launched From Encoded PowerShell  
references:  
   - https://www.joesandbox.com/analysis/search?threatname=clickfix  
tags:  
   - attack.execution  
   - attack.defense\_evasion  
   - attack.t1218.005  
author: Luke Rusten  
date: 2025/04/10  
logsource:  
   category: process\_creation  
   product: windows  
detection:  
   selection\_webclient:  
       CommandLine|contains:  
           - 'Net.WebClient\]::New()'  
   selection\_get\_member:  
       CommandLine|contains:  
           - '|GM|'  
           - 'Get-Member'  
           - '|GM)'  
   selection\_like:  
       CommandLine|contains:  
           - 'Value.Name -clike'  
           - 'Value.Name -like'  
           - '$\_.Name -clike'  
           - '$\_.Name -like'  
   selection\_parent:  
       ParentCommandLine|contains:  
           - 'powershell'  
   selection\_parent\_encoded:  
       ParentCommandLine|contains:  
           - ' -e '  
           - ' -en '  
           - ' -enc '  
           - ' -enco '  
           - ' -encod '  
           - ' -encoded '  
           - ' -encodedcommand '  
   condition: all of selection\*  
falsepositives:  
   - Unknown  
level: low

---

### **AMSI Bypass**

This detection is pretty specific and has only had minor tweaks to make it resilient for variable changes. 

title: Potential AMSI Bypass Technique Modifying CLR.DLL in Memory  
id: b9cfffb2-f4f8-455d-a167-21f59495f8f4  
status: experimental  
description: Detects use of AMSI Bypass Technique Modifying CLR.DLL in Memory  
references:  
   - https://practicalsecurityanalytics.com/new-amsi-bypss-technique-modifying-clr-dll-in-memory/  
   - https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell  
author: Luke Rusten  
date: 2025/04/12  
tags:  
   - attack.execution  
   - attack.t1059.001  
   - attack.t1106  
logsource:  
   product: windows  
   category: ps\_script  
   definition: 'Requirements: Script Block Logging must be enabled'  
detection:  
   selection:  
       ScriptBlockText|contains|all:  
           - '0x02'      # PAGE\_READONLY  
           - '0x04'      # PAGE\_READWRITE  
           - '0x40'      # PAGE\_EXECUTE\_READWRITE  
           - '0x20'      # PAGE\_EXECUTE\_READ  
           - '0x100'     # PAGE\_GUARD  
           - '0x1000'    # MEM\_COMMIT  
           - '260'       # MAX\_PATH  
           - 'if ($path.EndsWith("clr.dll"))' # We want to look for clr.dll in the script. This may be too specific for variations, but it works in every case we observed  
           - '$signature = \[System.Text.Encoding\]::UTF8.GetBytes' # Matches variations of $signature = \[System.Text.Encoding\]::UTF8.GetBytes($a + $b + $c + $d)  
   condition: selection  
falsepositives:  
   - Unknown  
level: low

---

### **PowerShell spawning remote debugging**

This detection may require some tuning for your environment, but it is unlikely to have a high false positive rate. If your detection engine supports it, you could supercharge this detection by alerting on 2 or more browsers with remote debugging initiated by PowerShell in a 30 second period. That would be highly unusual in most environments. In addition, the [Potential Data Stealing Via Chromium Headless Debugging](https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml) Sigma rule looks for similar behavior but may be more false positive prone. 

title: Browser Started with Remote Debugging Initiated By PowerShell

id: 3dfa8836-67c8-4658-bf6f-01d26cec6b4f

status: experimental

description: Detects browsers starting with the remote debugging flags initiated by PowerShell. This is a technique often used to perform browser injection and infostealer attacks

references:

   - https://www.joesandbox.com/analysis/search?threatname=clickfix

   - https://github.com/defaultnamehere/cookie\_crimes/

   - https://github.com/wunderwuzzi23/firefox-cookiemonster

author: Luke Rusten

date: 2025/04/10

tags:

   - attack.credential\_access

   - attack.t1185

logsource:

   category: process\_creation

   product: windows

detection:

   parent:

       ParentImage|endswith: '\\powershell.exe'

   selection\_chromium\_based:

       CommandLine|contains: ' --remote-debugging-'

   selection\_firefox:

       Image|endswith: '\\firefox.exe'

       CommandLine|contains: ' -start-debugger-server'

   condition: parent and 1 of selection\_\*

falsepositives:

   - Unknown

level: low

 

---

### **Run Key Persistence From a Lengthy Parent**

This rule may generate some false positives although it should not be many. **Verify that your detection engine supports this type of regex** and tune for your environment. The binaries observed in the Lumma Stealer cases were 26 and 28 characters, but baselining showed 23 was a pretty good sweet spot and only required a couple of tunes. You should baseline this in your environment and decide if you should increase the character count and tune out false positives.

title: Potential Persistence Attempt Via Run Keys Using Reg.EXE With Lengthy Parent

id: a6d9b48b-4394-4d5e-b026-9df096bfa186

status: experimental

description: Potential Persistence Attempt Via Run Keys Using Reg.EXE With Lengthy Parent

references:

   - https://www.joesandbox.com/analysis/search?threatname=clickfix

author: Luke Rusten

date: 2025/04/10

tags:

   - attack.persistence

   - attack.t1547.001

logsource:

   category: process\_creation

   product: windows

detection:

   selection:

       CommandLine|contains|all:

           - 'reg'

           - ' ADD '

           - 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'

       ParentImage|re: '\\\\\[a-zA-Z0-9\]{23,}\\.exe'

   condition: selection

falsepositives:

   - Some legitimate software although executable names are not typically that long

level: low

## Recommendations

**User Awareness & Training:** Educate users on recognizing deceptive prompts and CAPTCHA-like lures. Encourage hesitation before pasting clipboard content into **Win + R**.

**Behavioral-Based Detection:** Static IOCs change quickly. Behavioral detections will likely provide more resilience across several variants.

**Restrict Use of Run Dialog:** Disable or restrict **Win + R** functionality for non-administrative users using Group Policy. **(This should be thoroughly researched and tested before implementing).** [Guide: Disable Run Command](https://www.auslogics.com/en/articles/enable-or-disable-run-command-winr-box/)

## References

- [HHS Alert on ClickFix](https://www.hhs.gov/sites/default/files/clickfix-attacks-sector-alert-tlpclear.pdf)
- [Joe Sandbox Analysis - ClickFix](https://www.joesandbox.com/analysis/search?threatname=clickfix)
- [Microsoft Security Blog: Booking.com Phishing](https://www.microsoft.com/en-us/security/blog/2025/03/13/phishing-campaign-impersonates-booking-com-delivers-a-suite-of-credential-stealing-malware/)
- [ClearFake + Etherhiding Deep Dive](https://rhisac.org/threat-intelligence/clearfake-malicious-framework-updates-tactics-with-binance-smart-chain-obfuscation/)
- [Etherhiding on Blockchain](https://www.packetlabs.net/posts/etherhiding-a-new-tactic-for-hiding-malware-on-the-blockchain/)

[SecOps](https://blog.reconinfosec.com/tag/secops), [SOC](https://blog.reconinfosec.com/tag/soc), [Threat Hunting](https://blog.reconinfosec.com/tag/threat-hunting), [DetectionEngineering](https://blog.reconinfosec.com/tag/detectionengineering)

## Read On

### [SigmaHQ Essentials - Building Robust Detection Capabilities - Part 2](https://blog.reconinfosec.com/sigmahq-essentials_-building-robust-detection-capabilities-part-2)

Hello again!I'm back with part 2 of Building Robust Detection Capabilities. [Last](https://blog.reconinfosec.com/sigmahq-essentials-building-robust-detection-capabilities)[time](https://blog.reconinfosec.com/sigmahq-essentials-building-robust-detection-capabilities), we dove ...

### [OpenSOC: Camp COVID](https://blog.reconinfosec.com/opensoc-camp-covid)

Hello OpenSOC fam! First and most importantly, we hope that you and yours are healthy and happy in...

### [Camp COVID - A Recap](https://blog.reconinfosec.com/camp-covid-a-recap)

Let me first say, on behalf of the Recon team, we cannot thank the community enough for joining us...

© 2026 All rights reserved. [RSS Feed](https://blog.reconinfosec.com/rss.xml)