Imagine you're browsing the web and are asked to prove you're human by completing a small puzzle, one of those "CAPTCHA" tests. It feels fairly routine, as many companies adopt anti-bot technologies. Now picture ending up on a nearly identical page-but after solving the puzzle, you're tricked into installing something harmful.
In early 2024, researchers noticed an alarming trend called ClearFake, where hacked (WordPress) websites displayed fake pop-ups pretending to be browser update notifications. People were tricked into downloading malware called Lumma stealer, believing they needed to update their browser to keep using the internet.
Not long after, a more crafty version called ClickFix appeared. Instead of asking users to download something, ClickFix used fake CAPTCHA pages that looked legitimate and were easier to set up. These pages imitate common anti-bot messages but added a hidden twist: a "verify" button that silently copied a harmful command to the clipboard. Then, the prompt led users through seemingly innocent keyboard shortcuts that eventually guided them to run the command on their computer. In just a few seconds, the malware could steal their accounts, personal data, and passwords.
Takeaways:
- Trust your gut. If a site asks you to copy and paste something into a setting or prompt, stop and think twice-even if it claims to fix a problem
- Stick with familiar sites. Perform these checks only on websites you know and trust. Be cautious of unfamiliar ones that pop up suddenly-even if they seem legit
- Avoid installing or pasting anything unexpected. Especially when it claims to be a quick fix to a website issue.
- Use a good security extension or tool. Many tools now help block these clipboard tricks right in your browser
The danger is no longer flashy or obvious. It's the opposite-it's smooth, quiet, and relies on our willingness to help. But that's precisely what makes it powerful.
#ALTACyber
------------------------------
Genady Vishnevetsky
Chief Info Security Officer
Stewart Title Guaranty Company
Houston TX
------------------------------