api.recapcha.fun: a fake CAPTCHA address tied to the North Korean fake interview campaign, and what to do if you pasted its command

What api.recapcha.fun is, and what we know about it

api.recapcha.fun is not a program on your computer. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served. The tags on all three entries name a known style of attack: a fake job interview that ends with you running a command yourself. We found no public write-up of this one address, so below is what URLhaus shows, what our server saw, and what security vendors have published about the campaign the tags name.

1. 1

   What URLhaus lists

   Three addresses on api.recapcha.fun: /auth/v1, /auth/v2 and /auth/v3, each followed by ?token=304. Two were added at about 06:14:40 UTC and one at 06:14:54 UTC on 18 October 2026. All three are marked online, all carry the threat label malware_download, and all were submitted by one URLhaus contributor.

2. 2

   What the tags mean

   ClickFix is a trick where a page makes you run a command yourself. ContagiousInterview is the name researchers use for a campaign of fake job interviews. DPRK says the reporter links it to North Korea. fake-recruitment says the lure is a made up job offer. These tags are the reporter's reading; URLhaus shows them, not a court or a vendor verdict.

3. 3

   What we could not confirm

   We did not download anything from these addresses, so we cannot tell you what a pasted command fetches from them, which malware family it installs, or where that malware reports to. We also cannot tell whether the three addresses return different files for Windows and for Mac.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a warning, that alone does not mean you are infected. The risk is for a computer where someone pasted a command from a fake interview or fake CAPTCHA page and ran it. A normal visitor has no reason to open these addresses.

Kind of threat

A server that URLhaus lists for malware downloads in a ClickFix, fake recruitment campaign tagged ContagiousInterview and DPRK

Where the files are

hxxps://api[.]recapcha[.]fun/auth/v1?token=304, /auth/v2?token=304 and /auth/v3?token=304

Domain registered

22 July 2026 through HOSTINGER operations, UAB; status client transfer prohibited (RDAP, read 18 October 2026)

URLhaus entries

3 addresses, added 18 October 2026 at 06:14 UTC; all 3 online when we read our copy of the data

Name trick

recapcha imitates reCAPTCHA, Google's well known human check, so a fake check page looks normal. We read this as the purpose of the name; no report states it

Platform

Not known for these three addresses. The campaign the tags name has used commands for both Windows and macOS

What we checked on 18 October 2026, and what we could not

Our check was one plain request from our server to the address, with no browser, no clicks and no recorded session. It got an answer, but a quiet answer clears nothing: a lure page can show a harmless face to a server and the real page only to a person who arrived from a recruiter's link.

What happened to api.recapcha.fun, from registration to our check

The domain is under three months old and all reports came within seconds of each other. The dates come from RDAP and from the URLhaus data we hold; times are UTC.

1. 22 July 2026

   recapcha.fun is registered

   RDAP shows the domain recapcha.fun registered on 22 July 2026 at about 09:52 UTC through HOSTINGER operations, UAB. The status is client transfer prohibited, which is a standard lock against moving the domain; it says nothing about the owner's intent.

2. 18 October 2026, 06:14

   Two addresses are reported

   At about 06:14:40 UTC URLhaus receives /auth/v1?token=304 and /auth/v2?token=304, both tagged ClickFix, ContagiousInterview, DPRK and fake-recruitment, with the threat label malware_download.

3. 18 October 2026, 06:14:54

   A third address follows

   Fourteen seconds later /auth/v3?token=304 is added with the same tags. The three paths differ only in the version number, which looks like one operator trying versions of the same endpoint. That is our reading of the names.

4. 18 October 2026, 07:26

   Our check

   We read the registration record and made our plain request. The server answered with status 200, the title Vscode, and a Vercel server header. All three URLhaus entries were still marked online.

What the pattern suggests, and what it does not: a domain registered in July and reported in October fits a lure that was prepared in advance and is now being used. We do not know how many people received the link, and URLhaus does not count visitors.

How a fake interview ends with you running a command

The tags describe a campaign that several vendors have written about. We did not watch this server do it, so the chain below is how Microsoft, Unit 42 and others describe the campaign, not a recording of this address.

1. 1

   A recruiter reaches out

   Unit 42 describes fake recruiter profiles on social media that approach people looking for tech jobs. The Hacker News, reporting on research from 2024, describes recruiters who share code projects hosted on GitHub, GitLab or Bitbucket as a technical test. The job is invented and the pay is often high.

2. 2

   A page throws up an error

   In the 2025 wave reported by The Hacker News, victims were asked to record a self assessment video and were then shown a fake microphone error. In a related pattern, the link showed an error and told the target to update video call software. The fix offered is a command.

3. 3

   The page copies a command for you

   Microsoft describes how a fake CAPTCHA or human check copies a command to the clipboard without telling you, then asks you to paste it into the Windows Run dialog, Windows Terminal or PowerShell. Because you run it, many automatic controls do not stop it.

4. 4

   The command downloads the malware

   The command contacts a server and runs what comes back. In this campaign researchers name BeaverTail, a JavaScript stealer and downloader, which fetches InvisibleFerret, a Python backdoor. The Hacker News also reports compiled BeaverTail programs for Windows, macOS and Linux, and says some chains deliver OtterCookie. Which of these an address like api.recapcha.fun serves is not known.

Microsoft adds that many ClickFix payloads run in memory through normal Windows programs such as powershell.exe, msbuild.exe or regasm.exe. That makes a file scan alone a weak test and is why this guide asks you to check more than files.

What ContagiousInterview and the DPRK tag mean

ContagiousInterview is a name vendors use for a long running campaign. The sources agree on the lure and the malware names and differ a little on dates and numbers, so we give each claim with its source.

What this kind of malware can take from your computer

The campaign's stealers are aimed at money and logins. The list below is what the sources say the family does in general, not what a file on this particular server does.

What this can cost you

Reading this page or seeing the name costs nothing. The risks below apply to a computer where someone ran a command from a fake interview or CAPTCHA page.

• High

  Crypto and wallets

  The campaign is described as aimed at cryptocurrency theft. Coins sent from a stolen wallet cannot be pulled back. A seed phrase that was ever stored on the computer should be treated as known.

• High

  Passwords and sessions

  A stealer can take saved browser passwords and the cookies that keep you signed in. Changing passwords on the same computer does not help while the malware is still there.

• High

  Someone using your computer

  A backdoor such as InvisibleFerret lets a person return later. It is not a one time theft.

• Medium

  Work accounts and code

  The lure targets people who apply for jobs, often with a work laptop. Source code, company logins and cloud keys on that laptop become a risk for an employer too. Tell your security team at once.

• Medium

  More malware

  The chains described deliver several families one after the other, so one detection may not be the whole story.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Stealers and backdoors are built to be quiet. The signs below follow from the sources; none is certain, and many victims notice nothing for a while.

How people end up on a page like this

Nobody finds api.recapcha.fun by chance. It is a link someone sends, so the real question is who sent it and why. The routes below are the ones the sources describe for the same campaign.

1. 1

   A message about a job

   Unit 42 describes fake recruiters on social media. Reports collected in the Reuters piece describe contacts over LinkedIn and Telegram that move to a skills test or a video assessment. The company names used can be real firms, so a known brand proves nothing.

2. 2

   A skills test or video that fails

   The page says the microphone, camera or CAPTCHA failed, and offers a fix that is a command. A real company's interview tool does not ask you to paste commands into a terminal.

3. 3

   A project to run on your own computer

   The older version of the campaign asked candidates to download a code project and run it. The Hacker News describes bogus npm packages and trojanized projects hosted on code sites. Running unknown code on your main computer is the same risk as pasting a command.

4. 4

   A video call tool to install

   The Hacker News describes installers shaped as MSI files and macOS disk images that pretended to be the MiroTalk video conferencing software, and fake updates for apps like VCam or CameraAccess.

Check your computer before you delete anything

Start with the question that matters: did you paste or run a command, or install an app, after a recruiter's message or a CAPTCHA that would not go away? If you saw the name in a log from your own network, find the device that asked. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the computer for banking, email, work or crypto. Disconnecting from the network is the first move.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the cable. A backdoor needs the connection to be used, and a stealer needs it to send what it took.

2. 2

   Remember the moment

   Think back to when a page asked you to press Win+R, open Terminal or PowerShell, or paste something. Write down the time and the site. This tells you which device and which day to look at.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around that time. A detection with a name containing BeaverTail, InvisibleFerret, Lumma or a generic Trojan or Script name is a sign.

4. 4

   Look at Startup apps and Task Scheduler

   Open Settings > Apps > Startup and look for names you did not install. Then press Start, type Task Scheduler, open it and check the Task Scheduler Library for tasks you do not know. Do not delete yet; write the name and the program it runs.

5. 5

   Look at running programs

   Open Task Manager and look for powershell.exe, msbuild.exe, regasm.exe, node.exe or python.exe running with no reason or with heavy network use. They are real programs, so their presence is not proof, and their absence does not clear the computer.

6. 6

   Look for a code project you ran

   If the recruiter sent you a project, note the folder and whether you ran npm install or a start command. The Hacker News describes malware hidden in such projects. Do not run it again.

7. 7

   Check your accounts from another device

   Look at the sign in activity of your email, bank, work and exchange accounts, and at crypto balances. This is quicker than any file check.

8. 8

   A scan helps, but it does not clear the computer

   A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a clean site test: one data point. We did not infect a computer with this server's files, so the order of the plan is our judgement from Microsoft's pages, not a tested result.

If you use a Mac, an iPhone or an Android phone

The page title and the tags do not say which system the three addresses target. The campaign the tags name has had macOS versions, so a Mac user who pasted a command should not assume safety.