Scammers have learned to infect computers with fake captchas

Attackers began using fake captchas (Captchas) to force users to independently run malware on computers. This is reported by The Guardian.

The scheme is called ClickFix. The user is asked to confirm that he is not a robot, for example, to tick in a special field. After that, the site shows the instructions: press the key combination Windows + R, then Ctrl + V and Enter.

The Windows + R → Ctrl + V → Enter sequence allows you to quickly execute a command from the Windows clipboard.

Windows + R opens the Run window. Ctrl + V - inserts the contents of the clipboard into it (something that was copied automatically when clicking on a malicious "capcha"). Enter launches the inserted command.

Performing these actions leads to the launch of malicious code, which is pre-copyed into the clipboard. In some cases, instead of captcha, an error message appears on the screen with a suggestion to perform similar actions to eliminate it.

Chris Fistonich, a researcher at Malwarebytes, called ClickFix one of the most common ways to spread malware. He explained that users are used to passing CAPTCHAs daily and trusting security software, so they don’t always recognize a new threat.

“People are not prepared for this. They are used to daily CAPTCHA checks and trust their security software. - RBC. In fact, a new vulnerability has emerged, which is actively used by attackers, said Fistonich.

The Guardian recommends not to execute commands that are offered to enter on the site or in the system window, and use antivirus programs that can block malicious resources. If the computer is infected, you should contact the bank and change passwords, starting with the most important ones.

Captcha is an automatic verification tool that helps websites distinguish a person from a bot. For example, the user is asked to recognize characters in an image or select certain objects among several pictures.

In May, Deputy Chairman of the Council for the Development of the Digital Economy under the Federation Council Artem Sheikin warned about fraudsters who use fake captchas. Instead of the usual check, they offer users to press certain keys and run malware. This allows attackers to gain access to passwords, accounts and banking data.