Online shoppers looking for gifts from small businesses may encounter a deceptive verification step that looks like a standard Captcha test. Instead of clicking images or typing distorted letters, the site asks users to press a specific sequence of keyboard keys. This method, known as the ClickFix scam, is a sophisticated technique used by fraudsters to install malicious software on victims’ computers.
Chris Fistonich, a researcher at cybersecurity firm Malwarebytes, describes the ClickFix scam as one of the most advanced malware campaigns currently in circulation. He notes that the tactic exploits a common trust in familiar security measures. Users are accustomed to solving Captchas daily and generally believe their security software will block threats. This familiarity has created a new security loophole that criminals are exploiting extensively.
How the ClickFix scam works
Traditional Captcha tests are designed to distinguish human users from automated bots. They typically involve identifying objects in photographs or typing out grainy numbers. The ClickFix scam mimics this format but uses a different mechanism to compromise the system. The message may ask users to verify they are human by completing a specific action, such as ticking a box.
Checking the box grants the system permission to copy malicious code to the computer’s clipboard. The user is then instructed to press and hold the Windows Key and R key simultaneously. This opens the Run dialog window. The next step requires pressing Ctrl and V to paste the copied code, followed by pressing Enter to execute it. This sequence allows the malicious code to run directly on the system, resulting in infection.
Other variations of this fraud may display a message stating that something went wrong while displaying the webpage. These versions provide similar instructions to fix the issue, relying on the user’s desire to resolve the error quickly. The scam depends on users acting without thinking through the consequences of their actions.
Protecting your computer
Security experts advise pausing to consider what you are doing whenever you encounter unusual verification steps online. Many security software systems can block malicious websites that host malware traps. Users should check their current security settings to ensure they have adequate protection in place.
If a user suspects they have been compromised by the ClickFix scam, they should contact their bank immediately. It is also critical to change passwords, starting with the most important accounts. This step helps prevent further damage if financial information was accessed.
The ClickFix scam represents a significant shift in how criminals target everyday users. By leveraging the familiarity of Captcha tests, they bypass traditional skepticism. As this method continues to gain popularity, staying vigilant and understanding the mechanics of the fraud is essential for maintaining computer security.
Source: The Guardian
