The ClickFix attack is a widespread social engineering technique that compromises legitimate websites to display a fake CAPTCHA overlay, which instructs users to paste and execute a malicious terminal command, leading to infection on both Windows and macOS systems. The article does not provide a CVE, CVSS score, or specific affected software versions, as this is a cross-platform attack vector exploiting user behavior rather than a software vulnerability. A primary workaround is user awareness training to never run unprompted terminal commands from a web browser.
It wasn’t that long ago that ClickFix attacks were exotic. Now the technique has become mainstream as attackers reap its simplicity and effectiveness in infecting users of PCs and Macs alike. All that’s required is a compromised website—a painless enough task—a fake CAPTCHA overlay, and the inclusion of a single terminal command. So many visitors get suckered into pasting and running the command that just about every malware pusher has adopted the technique. Even Kremlin-backed hacking groups are joining in. “Reddit is becoming post after post after post of people getting their computer infected via ClickFix,” independent researcher Kevin Beaumont observed Thursday . “Legit websites everywhere [are] getting hacked to serve the fake captcha prompts.” How many of us make things worse More seasoned Internet users—a fair number who read this site—are quick to dismiss the attack. They typically blame the people who fall for the scams and marvel at their gullibility and lack of attention. The reality is that for more casual users, using computers and the Internet has become so difficult—think impossible-to-close interstitials, CAPTHAs with an endless series of pictures to analyze, and constantly changing interfaces that bury the features they’re looking for—that they have grown desensitized to instructions that seem ridiculous and burdensome. Read full article Comments