The malware often hides behind fake CAPTCHAs and has been used to commit financial fraud. Microsoft took down 2,300 domains that ran it and updated Defender to identify it.