26/03/2025
The “ClickFix” CAPTCHA
We are all used to seeing the CAPTCHA verifications on the internet when you go to a webpage to “Verify you are a Human” or “I’m not a robot” CAPTCHA. Normally you tick the box and you need to perform some type of puzzle. They have become more complicated over time as the scams have gotten harder to stop.
A new type of CAPTCHA has surfaced and users need to be on the highest guard, as clicking the box & proceeding can infect your computer with a Remote Trojan - essentially allowing someone to take control of your computer.
First Image below: This is what we usually see and is fine to continue with (as many sites will still need this for verification).
Second Image: If you see this STOP immediately (this is the one with the additional text after the one we’re used to. DO NOT PROCEED.
If you see the Second Image asking you to do the following, STOP immediately.
If you tick the box, this is what happens. STOP IMMEDIATELY.
DON’T FOLLOW THESE INSTRUCTIONS:
The visitor is instructed to open the Windows RUN dialogue by pressing the keyboard’s Windows key then ‘R’. Doing that would give the RUN field the system’s focus. The next instruction was to press CTRL+V which would, of course, copy the malicious command that the JavaScript had pre-loaded onto the system’s clipboard into the Run command field. And, finally, the user was instructed to press Enter. If the user performed these steps, a Powershell script was executed on the user’s machine that downloaded further payloads and ultimately installed the remote access trojan SectopRAT.
