Cybersecurity researchers have identified a widespread campaign in which over 5,400 legitimate websites have been compromised to distribute malware. The attackers are using a technique known as ClickFix, which exploits the familiarity of CAPTCHA verification processes to trick users into executing malicious commands on their computers.
These compromised sites, which include those running on platforms like WordPress and PrestaShop, have affected more than 2,200 organizations globally. The victims range from clinics and plumbing companies to online retailers. While the exact method of initial compromise for these sites remains unknown, the result is that users visiting seemingly trustworthy websites can encounter deceptive prompts.
How the Malware Trick Works
The attack begins with malicious code embedded within a legitimate website. When a user visits the site, this code can load another script, leading to a blurred page that displays what appears to be a standard CAPTCHA. However, instead of the usual task of identifying images or clicking a checkbox, the fake CAPTCHA instructs users to open the Windows Run dialog and paste a command. Executing this command downloads and installs malware on the user's computer.
Researchers emphasize that a legitimate CAPTCHA will never instruct users to open system utilities like Windows Run or paste commands. This tactic relies on psychological manipulation, leveraging the user's trust in familiar websites and CAPTCHA procedures to bypass their defenses.
Blockchain and Evolving Tactics
In a more unusual aspect of this campaign, attackers are reportedly storing instructions for the malware within a smart contract on the test network of the BNB Smart Chain. This approach makes it more difficult for security teams to shut down the operation by traditional means, as blockchains are designed to be decentralized and resistant to takedowns.
Furthermore, the campaign has evolved to include a version that bypasses the fake CAPTCHA entirely. This newer tactic utilizes WebRTC, a technology typically used for real-time communication like video calls, to create a direct, encrypted connection between the user's browser and an attacker-controlled server. This allows for the delivery of additional malicious code that can run without being saved as a distinct file on the computer.
Protection and Prevention
Security experts recommend several measures to protect against such threats. Users should never paste computer commands from a website and should be wary of any CAPTCHA instructions that deviate from standard verification methods. Maintaining updated antivirus software and keeping operating systems and browsers patched are also crucial.
If a user suspects they have fallen victim to such a scam by executing a command, they should immediately disconnect the computer from the internet, perform a full antivirus scan, and change passwords for sensitive online accounts. Enabling multifactor authentication is also advised.
Website owners are urged to maintain the integrity of their sites by regularly updating their content management systems and plugins, and removing any unused ones. While specific vulnerabilities for this campaign have not been identified, these practices are considered good general security hygiene.