Summary
It wasn’t that long ago that ClickFix attacks were exotic. Now the technique has become mainstream as attackers reap its simplicity and effectiveness in infecting users of PCs and Macs alike. All that’s required is a compromised website—a painless enough task—a fake CAPTCHA overlay, and the inclusion of a single terminal command. So many visitors get suckered into pasting and running the command that just about every malware pusher has adopted the technique. Even Kremlin-backed hacking groups are joining in. “Reddit is becoming post after post after post of people getting their computer infected via ClickFix,” independent researcher Kevin Beaumont observed Thursday. “Legit websites everywhere [are] getting hacked to serve the fake captcha prompts.” How many of us make things worse More seasoned Internet users—a fair number who read this site—are quick to dismiss the attack. They typically blame the people who fall for the scams and marvel at their gullibility and lack of attention. The reality is that for more casual users, using computers and the Internet has become so difficult—think impossible-to-close interstitials, CAPTCHAs with an endless series of pictures to analyze, and constantly changing interfaces that bury the features they’re looking for—that they have grown desensitized to instructions that seem ridiculous and burdensome. ClickFix attackers are capitalizing on this fatigue. Typically, attacks begin with a simple CAPTCHA image, often masquerading as one from Cloudflare. After engaging with the box, the user sees a line of text, often obscured in a way to mask any malicious commands. Then the user is instructed to copy the text and paste it into the Windows Run, PowerShell, or macOS terminal and click Enter. The instructions come from websites people have used for years. The directions seem no more suspicious than things they’ve been required to do for a decade. Why would someone without a firm grasp of computer security have any reason to hesitate? We have more usability experts than ever and yet somehow usability is worse than it’s been in y ears. Then the same industry causing the problems acts holier-than-thou when people don’t successfully navigate their garbage and get caught up in attacks like this. And don’t even get me started on the “business incentives” that come into play. Everyone knows those goddamn “subscribe and save 10%” pop-ups are horrible, and yet… That’s also how you get dark patterns like inescapable checkout flows, products auto-added to your cart, etc. It’s pretty depressing at times, tbh. They don’t know its a “terminal”. Its just a text box when you hit Win-R. See this example video from the first article about Click Fix For most people, computers are black boxes that they use to do things, not something they understand the inner workings of. Just look at all the people who close error messages without reading them… Then they tell you to CTRL-V and press OK.