technology

The con has opened a security loophole widely exploited

A fake Captcha scam called ClickFix is described as a leading way criminals trick people into installing malware on their own computers today, reports say.

prove, captcha, unlike, christmas, instead, computer, robot, scam

Key facts

  • Like many frauds, ClickFix depends on people acting quickly and without thinking through what they are doing. The warning is to pause and consider…
  • The con has opened a security loophole that is being exploited extensively, a specialist quoted by the paper said. He called it the most popular way…
  • This version works differently. Instead of those familiar checks, it asks the user to press a series of keys and then press enter.

Like many frauds, ClickFix depends on people acting quickly and without thinking through what they are doing. The warning is to pause and consider each step whenever you are online.

The con has opened a security loophole that is being exploited extensively, a specialist quoted by the paper said. He called it the most popular way to get malware onto a computer.

This version works differently. Instead of those familiar checks, it asks the user to press a series of keys and then press enter.

The page frames the request as a test. Visitors are told they must better prove they are not a robot, and are then given keyboard instructions.

Checking a box on the page gives the system permission to copy malicious code to the clipboard on the computer, The Guardian reported.

Following the prompts pastes that hidden text into the system. The result is that the computer is infected.

Other versions of the same scam tell users that something went wrong when displaying the webpage. They then offer similar instructions, presented as a way to fix the problem.

The specialist said the method was certainly not the only way criminals plant malware, but that today it is definitely the most popular.

Dig deeper

What is ClickFix?

ClickFix is an online fraud that poses as a routine webpage check or error fix and tricks people into following steps that infect their computer with malware.

How does the fake robot test work?

Instead of a normal on-page check, visitors are told to press a series of keys and Enter, which pastes hidden text already copied to the clipboard and infects the computer.

Why does a checkbox matter in this scam?

Checking the box is presented as proof the visitor is not a robot, but it gives the page permission to copy malicious code onto the computer's clipboard.

Are there other versions of the same con?

Yes. Some pages claim the webpage failed to display and then offer similar keyboard instructions as a supposed fix.

Why does this matter?

The method is not the only way criminals plant malware, but a specialist described it as currently the most popular, because it depends on people acting quickly without pausing.

Lire en français