Forest Global Training Partners

Cyber Risks · Krebs on Security

Click Fix: How to Infect Your PC in Three Easy Steps

Summary: A malware scheme called ClickFix, first seen in targeted attacks last year, now tricks visitors to hacked or malicious sites into running a fake CAPTCHA that walks them through three keypresses - Windows+R, CTRL+V, Enter - which makes Windows download password-stealing malware via mshta.exe. Microsoft says the campaign delivers XWorm, Lumma stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, and has been used against hospitality workers through emails impersonating Booking.com and against healthcare staff via malicious code on the physical therapy video site HEP2go.

What's compelling: The entire infection chain depends on a user pressing three keys, and Microsoft notes that Group Policy can block the Windows+R Run command - so the control that stops this is one most organizations have never configured.

Read the original at Krebs on Security ↗

Topics
Malware
Related