alt Hacker NewsThis is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.
The attack is basically getting someone to accidentally run malicious code.
- ctrl + R brings up the Windows "run" dialogue.
- the code executes a powershell command that reaches out to a remote server
- if successful, the remote server answers and you have installed a dropper or something.
Really, you should never do _anything_ like this for any website. You don't need to protect yourself. This is sort of equivalent (in the strict metaphorical sense) of getting a call from your bank and they ask you for your banking password: you just never do it, no matter what. Same thing here. You don't ever execute code via the run dialogue to solve a CAPTHCA. Never.
https://www.sentinelone.com/blog/how-clickfix-is-weaponizing...
Replies
I've seen sites with similar fake captchas posted twice in the last month by old time regular users. My guess is that the sites were infected after they saw and decide to post it here.
As a workaround, is it possible to disable Ctr+R to add some friction in case I am distracted?
$dayjob just sent out a corporate wide email saying the same thing... I guess it's starting to go around... it's been a while since I've seen a fake website telling people to eg. disable UAC.
> There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.
I think the concern is the user not knowing they're executing code on their machine.
And as a counterexample: some captchas require you to compute something expensive to prove you're not a llm scraper or whatever. It's normal for captchas to require you to execute code on your machine, it's just usually done within the browser's sandbox.
And anyway, these things are completely incomprehensible to non-technical users.