ClickFix Malware Is Going Viral, Infecting PCs And Macs With CAPTCHA Prompts
The way the attack works is very simple. A malicious advertisement pops up with a realistic-seeming challenge for users to solve to access the website. These sorts of things have become so common that most people are desensitized to them. If you don't know any thing about Windows, then you don't know any better than to do exactly as the popup says: press the Windows+R key combination to open the Run dialog, press Ctrl+V to paste the malicious text that the site has copied into your clipboard, and then press enter to pwn your own machine.
The malicious text is the important part, of course; it's a carefully crafted string that will open Powershell and then download a script which will install the malware onto your machine from the Internet. Once upon a time it was commonplace for web browsers to have the Clipboard access permission disabled by default, which would defeat this attack. Moreover, a little user education to teach Windows consumers that they should never be using the Run dialog for anything to do with the Internet would also serve to protect them.
It's possible to disable the Run command trivially using Group Policy, but crafty black hats have already worked around that particularly protection with the TerminalFix variant that instead asks users to use the Win+X power user menu to directly open Powershell instead. It's possible to disable the Win+X menu, too, but it takes a fair bit more doing, although if you're a system administrator there are detailed instructions in the Fediverse thread, which you can find here.
More recently, though, these attacks have even been tailored for MacOS computers. After all, thanks to being fundamentally based on Unix, Macs (at least since OS X in 2001) had more powerful terminal capabilities than Windows did to begin with. Windows didn't get a useful version of Powershell until 2009. The Mac exploit, shown above, even shows the user what command they're executing, but the critical portion is base64 encoded so that regular users can't, for example, Google the command and figure out that they're being bamboozled. Security analyst Mehmet Buğra Şahinoğlu goes over one specific version of the MacOS ClickFix in intense detail on his blog, if you're interested.
Really, though, the long-term solution to this issue is user education. You don't have to turn them into system administrators overnight; all you have to do is explain that when a website asks you to do something on your local PC, outside of the browser window, you should basically never do it. Any interactions with websites, at least for normal, non-developer users, should take place within the browser window. A little bit of education on the reality that things coming from the internet can and will be adversarial can go a long way.
