Fake CAPTCHA tests trick users into running malware Microsoft's security team has published an in-depth report into ClickFix, the social engineering attack which tricks users into executing malicious commands in the guise of proving their humanity. ClickFix pretends to be a standard CAPTCHA challenge. But, instead of clicking squares with motorbikes in them, sliding a puzzle- …
There's several vendors where I've abandoned buying whatever, when the payment system insisted on a captcha.
My insurance company started using it, so I've been calling and playing really stupid, saying "its popping up some sort of puzzle, have you been hacked?" and then when I share the screen with the support rep I start arguing over which squares include a banana or not. Eventually he tore all his hair out and gave me a back door that doesn't do captcha. Took an hour, though.
What I particularly hate is when it fails and you have no idea if it's you, so you have to have several attempts to be sure it's them! Some people's setups seem to fail when using a VPN. And ... there's the grainy pictures, is it a bus in the distance?? But like your insurance company my bank tries to push everyone to its app. When the phone person suggests using it, I explain it doesn't work with my phone which is more secure and blocks privacy theft. I get an "oh" in response and then they help.
My worst was a series of 9 captcha forms to persuade Abbot Diagnostic to let me download my glucose monitoring data having had to supply a user ID, password and enter the code they sent me via email. I had no idea what was the error each time and thought they must be getting paid for how many captchas they can get people to complete.
I complained and the worst recently is 3 captchas
But it's now like Keynes's description of the stock market. You aren't guessing which is a bus, you are guessing which picture a million other people, who have never seen a US school bus, think is a bus.
Of courses now that the AI are trained on the same images you have to detect which ones nobody else thought was a bus.
Click on all the photos of Sidewalk Boondoggles that have Chad Jerky on them and other US stuff.
As for clicking in a box, they must have a script that can move a mouse pointer to that.
All this is old hat anyway. The real money is in fake age verification now. Send us a scan of your passport and a photo of your last gas bill and we can lubricate your passage to the growed-up bits of the net, like Wikipedia (which Starmer's Reich will be targeting next).
"The company's report also advises that users should "block web pages from automatically running [Adobe] Flash plugins," an unexpected piece of not-exactly-timely advice given that Adobe killed Flash Player more than four years ago."
I smell copilot being used to write this advise and therefore responsible for including a technology that has essentially been dead for a long time now. As if you are using a browser that supports Flash in 2025 then your likely to be running one that is at least 5 years out of date, so a fake CAPTCHA is the least of your worries if you're going online with a browser that old.
I'd be interested to see a graph of Internet usage, in terms of hits perhaps alongside the amount of malware attacks like this. Has security improved the situation or just escalated the war to ever more devious or complex attacks combatted by ever more complex and expensive security software? Who are the big winners; users, hackers or security businesses?
... Microsoft recommends turning your personal computer into the equivalent of a 1990s-style TV screen+Internet-connected set-top box with no local storage, and turning your hammers into marshmallows, "for your safety".
Real, useful tools require user education and user responsibility. You don't hand out compressed-air-powered nail-guns to random passersby at a streetcorner.
Where an attacker can put whatever they want in the clipboard without the user having to trigger any copy command.
Browsers should NOT implement such malfunctionality, or at least prompt for permission stating that the page wants control over the clipboard (with a clear warning that the page will be able to read anything in the clipboard at any time and insert commands that run malware if executed).
How commands in the clipboard can end up being executed if you execute them isn't really a vulnerability.
So what exactly are home users and three people+dog business to do? Deploy loads of group policy when the editor in Intune requires extraordinary Microsoft super powers to even understand let alone use? How about Microsoft make your OS secure by default by flagging these sorts of commands as “likely to damage your computer”? Hmm?
It's amazing after all these years they aren't helping themselves.
Had to start up an old Win10 machine "for reasons". It starts doing a series of updates and one bit of the update needs to reboot while another update is still downloading. The restart message pops up a box saying something like:
"systemcore master-control-program prohibited by special services secret-double-probation mode in tron.dll". Ignore Y/N?
The fake CAPTCHA tells them to hit the Windows/Super key and R, then Control and V followed by Enter – a combination which, any reader who's used a computer for more than a week or so will likely recognize, opens up the Windows Run prompt, pastes whatever the attacker placed in the clipboard, and executes it.
I've used a computer for more than a week - 48 years, actually. I had literally no idea that "Windows/Super key and R" opened up a "Windows Run prompt". Looks like I've learnt something useful today.
