Technology1 min read

‘Prove you are not a robot’: how the Captcha scam captures your computer

By · Via The Guardian Business · Published by Everything Blog

In short

The fraudulent process substitutes standard image-identification tests with deceitful instructions that tell users to resolve a display problem. Unbeknownst to the victim, ticking a fake verification box silently copies harmful code onto their clipboard. The prompt then instructs the user to press the Windows Key and R, paste the copied text using Ctrl + V, and press Enter to run the payload. Users suspecting an intrusion should swiftly notify their banks and update passwords for their most vital accounts.

Key points

  • Individuals should pause before following unusual manual browser instructions that reques…: Individuals should pause before following unusual manual browser instructions that request system-level keyboard shortcuts.
  • Maintaining updated security software can protect computers by actively blocking access t…: Maintaining updated security software can protect computers by actively blocking access to known malicious domains.
  • Compromised users must immediately change passwords on primary accounts and alert their b…: Compromised users must immediately change passwords on primary accounts and alert their banks to prevent further damage.

Sources checked by our analysis pipeline: 1

You are looking for some gifts for Christmas and want to support small businesses when you shop. When you visit the site of one you’ve heard good things about you are asked to verify that you are human.

Instead of clicking on a series of images, or typing letters that appear, just as you have seen before, you are asked to press a series of keys and then press enter.

This is a tactic known as the “ClickFix” scam one of the most popular used by criminals to trick people into infecting their own computer with malicious software, according to Chris Fistonich, a researcher with cybersecurity company Malwarebytes.

“ClickFix is really one of the most sophisticated malware campaigns there is,” he says. “People are not prepared for this. They are used to solving Captchas every day. They’re used to being able to trust their security software. So it really has opened a new security loophole that’s being exploited extensively.”

He adds: “This is the most popular way to get malware on to your computer. Certainly not the only way, but…

Technology