Prove You Robot Captcha Scam Tricks Users Into Installing Malware
A fake human-check page called ClickFix asks users to press Windows Key + R and paste text. Malwarebytes researcher Chris Fistonich says it is now the most popular way to put malware on a computer. Here is how it works and what to do.
A fake "prove you robot captcha" test that asks users to press keys on their keyboard is now the most popular way criminals put malware on computers, according to Chris Fistonich, a researcher at cybersecurity company Malwarebytes. The tactic is known as ClickFix.
It works on people who already trust Captcha checks. Instead of clicking pictures of bikes or typing grainy letters, the visitor is told to press a series of keys and then hit enter.
How the ClickFix trick works
The scam can start on an ordinary-looking shop page. A victim hunting for Christmas gifts might visit a small business they have heard good things about and be asked to verify they are human.
The message may read "Verify you are human by completing the action below" and ask for a tick in a box. Ticking it gives the site permission to copy malicious code to the computer's clipboard.
The page then gives instructions: "To better prove you are not a robot, please: Press & hold the Windows Key + R. In the verification windows, press Ctrl + V. Press Enter on your keyboard to finish."
That sequence pastes the hidden text into the system and infects the computer. The victim has, in effect, run the attacker's code by hand.
Other versions skip the Captcha look. They claim "something went wrong when displaying this webpage" and offer similar steps as a fix.
Why it works
Fistonich said people are not ready for it. "ClickFix is really one of the most sophisticated malware campaigns there is," he said. "People are not prepared for this. They are used to solving Captchas every day. They're used to being able to trust their security software."
He said that has opened "a new security loophole that's being exploited extensively." He added that it is certainly not the only route for malware, but "today it is definitely the most popular."
Real Captcha tests exist so a website can tell human visitors from automated ones. They typically ask users to pick out images or type distorted characters. They do not ask you to open system windows or paste anything.
What to do
Like many scams, ClickFix relies on speed. Victims act before they think, so pause whenever a site asks for something unusual.
Some security software can block malicious websites that carry malware traps. Check what protection you have in place.
If you think you have been compromised, contact your bank immediately. Then change your passwords, starting with the most important ones.
Take the quizWhat Kind of Holiday Spender Are You? Take the Black Friday QuizStart →- 1Column: 4 Reasons to Eat Dark Chocolate, Dietitians Say
- 2Mavericks Surfers Race to California for Waves Near 50 Feet
- 3Chrissie Swan, 52, Tears Up Over Secret Surprise While Recovering
- 4Meghan Markle Plans US Return to See Mother After Father’s Arrest
- 5Aspyn Ovard Reveals Daughter Has Terminal Cancer on Mormon Wives
Lifestyle · Food & HealthThanksgiving Food Safety: How Long Leftovers Last and the Safe Turkey Temperature
Lifestyle7 Quiet Habits of Emotionally Intelligent People, According to Psychologists
LifestylePeople Who Don’t Like Celebrating Their Birthday Often Share These 7 Traits
Lifestyle · Food & HealthVitamin D in Winter: Do You Need a Supplement, and How Much?
