T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate

The anti-analysis gate of the ShinyHunters "The Com" claims-impersonation kit loads a real Cloudflare Turnstile widget while presenting the victim a pixel-clone of Google reCAPTCHA; the live Turnstile element is mounted over the fake reCAPTCHA at 1% opacity so the victim clicks what looks like "I'm not a robot" from Google and actually solves Turnstile. In the reversed build the kit injects Turnstile via a script tag whose onload callback is the distinctive "__onTurnstileReady", loaded from challenges.cloudflare.com, on a page that is simultaneously serving a cloned Okta login (see the companion oktaverify.svg rule). Turnstile alone is common on the legitimate web, so this rule keys on the kit's specific loader callback and pairs it with the presence of the cloned Okta asset on the same host to separate the gate from benign Turnstile deployments. The reCAPTCHA-over-Turnstile inversion is a DOM-level artifact confirmed at the browser (a gstatic reCAPTCHA image and a Google policies "Terms" link rendered alongside a Turnstile iframe at near-zero opacity); where DOM telemetry exists, alert on that co-occurrence directly. This gate is what redirects sandboxes and scanners to okta.com and admits only a live, operator-approved victim, which is why passive crawling of these domains sees nothing.

Intel context

This detection responds to live corpus signal — the intel below is what its ATT&CK techniques are exercising right now (recomputed September 18, 2026).

Technique	KEV CVEs	OSINT cites	Active families
T1036.005 Match Legitimate Resource Name or Location	1	0	—
T1557 Adversary-in-the-Middle	4	0	—

KEV CVEs mapped to this technique

Known-exploited vulnerabilities MITRE attributes to this ATT&CK technique — not necessarily to this specific campaign. They establish that the technique is under active exploitation, which is why a detection for it is worth authoring.

CVE	Vendor / Product	EPSS	Ransomware
CVE-2022-1040	Sophos / Firewall	0.998	—
CVE-2023-26360	Adobe / ColdFusion	0.973	—
CVE-2025-31200	Apple / Multiple Products	0.186	—
CVE-2019-5591	Fortinet / FortiOS	0.184	ransomware
CVE-2025-31201	Apple / Multiple Products	0.139	—

Rule ID: f01e0005-f4a1-470c-84ed-3e9e33218f39
Status: experimental
Level: high
Log source: category: proxy
Date: 2026-09-12
Modified: 2026-09-12
ATT&CK: T1036.005 , T1557 (signal rollup)
Canonical YAML: t1557-recaptcha-skinned-turnstile-gate.yml

References

False positives

Legitimate sites that both deploy Cloudflare Turnstile and happen to name their onload callback __onTurnstileReady. The callback name is developer-chosen and not unique, so treat selection_turnstile_kit_loader as a lead rather than a verdict and confirm the page is an Okta clone before acting.
Legitimate Okta-integrated applications that place a Turnstile challenge in front of their own genuine Okta login. Confirm the host is not a lookalike; a real Okta customer domain is not this campaign. Allowlist known-good first-party hosts.
Security tooling that renders phishing pages for analysis and thereby loads both the reCAPTCHA clone and the real Turnstile. Exclude the tooling egress.

Rule YAML

title: 'T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate'
id: 'f01e0005-f4a1-470c-84ed-3e9e33218f39'
status: 'experimental'
description: 'The anti-analysis gate of the ShinyHunters "The Com" claims-impersonation kit loads a real Cloudflare Turnstile widget while presenting the victim a pixel-clone of Google reCAPTCHA; the live Turnstile element is mounted over the fake reCAPTCHA at 1% opacity so the victim clicks what looks like "I''m not a robot" from Google and actually solves Turnstile. In the reversed build the kit injects Turnstile via a script tag whose onload callback is the distinctive "__onTurnstileReady", loaded from challenges.cloudflare.com, on a page that is simultaneously serving a cloned Okta login (see the companion oktaverify.svg rule). Turnstile alone is common on the legitimate web, so this rule keys on the kit''s specific loader callback and pairs it with the presence of the cloned Okta asset on the same host to separate the gate from benign Turnstile deployments. The reCAPTCHA-over-Turnstile inversion is a DOM-level artifact confirmed at the browser (a gstatic reCAPTCHA image and a Google policies "Terms" link rendered alongside a Turnstile iframe at near-zero opacity); where DOM telemetry exists, alert on that co-occurrence directly. This gate is what redirects sandboxes and scanners to okta.com and admits only a live, operator-approved victim, which is why passive crawling of these domains sees nothing.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1557/'
    - 'https://attack.mitre.org/techniques/T1036/005/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.credential_access'
    - 'attack.t1557'
    - 'attack.defense_evasion'
    - 'attack.t1036.005'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_turnstile_kit_loader:
        cs-host: 'challenges.cloudflare.com'
        cs-uri-query|contains: 'onload=__onTurnstileReady'
    selection_turnstile_api:
        cs-host: 'challenges.cloudflare.com'
        cs-uri-stem|startswith: '/turnstile/v0/api.js'
    selection_okta_clone_referer:
        cs-referer|contains: 'oktaverify.svg'
    condition: 'selection_turnstile_kit_loader or (selection_turnstile_api and selection_okta_clone_referer)'
falsepositives:
    - 'Legitimate sites that both deploy Cloudflare Turnstile and happen to name their onload callback __onTurnstileReady. The callback name is developer-chosen and not unique, so treat selection_turnstile_kit_loader as a lead rather than a verdict and confirm the page is an Okta clone before acting.'
    - 'Legitimate Okta-integrated applications that place a Turnstile challenge in front of their own genuine Okta login. Confirm the host is not a lookalike; a real Okta customer domain is not this campaign. Allowlist known-good first-party hosts.'
    - 'Security tooling that renders phishing pages for analysis and thereby loads both the reCAPTCHA clone and the real Turnstile. Exclude the tooling egress.'
level: 'high'

The YAML file above is the canonical artifact — machine consumers should subscribe via /sigma/manifest.json and fetch t1557-recaptcha-skinned-turnstile-gate.yml directly. Each rule's live intel context is in /sigma/evidence.json keyed by slug. This page is a rendered view, regenerated daily.