Captcha | 272

But a new tactic is tricking users into infecting their own computers by following fake “CAPTCHA” instructions to prove they are a human.

• Text is automatically copied to your clipboard when you click the check box
• “Windows Key + R” opens a “Run” prompt on your computer, something which allows you to enter in commands to your machine
• “Ctrl-V” pastes the copied text into the “Run” prompt, after which they have you press enter, running the command

From there, malware that can steal passwords, monitor activity, and provide remote access is silently installed on your machine. You are then given a “verification successful” message, and are redirected to a real website, unaware of what just happened.

BEMA has seen this attack delivered through phishing emails, online ads, and compromised websites.

This tactic, which is being dubbed the “ClickFix” campaign, often appears as a fake verification prompt (as seen above) or as “troubleshooting steps” (as seen below).

• Don’t follow these steps: Real websites will never ask you to copy/paste code like this.
• Avoid untrusted links: Especially those coming from an email or sponsored ad.
• Report it to BEMA: If you are prompted to do something like this, reach out to us immediately.

BEMA Security Motto:

• Be suspicious of everything
• Verify verbally
• See something, say something