This technique, known as ClickFix Captcha, exploits users’ trust in familiar web elements to bypass traditional security measures and deliver malicious payloads to Windows systems. The researchers noted the commands typically invoke PowerShell to download and execute additional malicious code while displaying deceptive “Verification complete” messages to maintain the illusion of legitimacy. What makes ClickFix particularly dangerous is the attackers’ implementation of rewrite rules and PHP-based proxies on compromised servers, allowing them to generate unlimited unique URLs for malware distribution while concealing the actual origin of the malicious content. Unlike traditional captchas that require users to identify objects or type text, ClickFix captchas instruct users to perform specific actions on their computers, such as pressing Windows key + R, claiming this will verify they aren’t bots. Dark Atlas researchers detected that when users follow these instructions, they unwittingly execute malicious commands that have been preloaded into their clipboard. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. A sophisticated cyber espionage campaign targeting Ukrainian entities has been uncovered, revealing the latest tactics of the Russia-linked Gamaredon threat actor group. When users press Windows key + R after interacting with the captcha, they open the Run dialog, and the malicious command in their clipboard is automatically inserted. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. A sophisticated social engineering technique has recently emerged in the cybersecurity landscape, rapidly gaining traction among threat actors seeking to distribute trojans, ransomware, and particularly Quakbot malware. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. One captured example showed commands to retrieve “flswunwa.zip” and extract its contents, which would then establish persistence and potentially exfiltrate sensitive data.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 29 Mar 2025 09:20:05 +0000