ClickFix has gone mainstream: one pasted command hands over the machine
The attack needs only a compromised site, a fake verification box, and a single line the user runs themselves. Windows and Mac make no difference.
Not long ago ClickFix attacks were exotic. The technique is now mainstream, because it is simple: all an attacker needs is a compromised website, a fake verification box, and one line of command the user runs themselves. Windows, macOS and Linux make no difference.
How it works
A verification screen appears on the site you are visiting. It looks familiar, but what it asks for is not. Instead of ticking boxes or picking images, it asks you to copy a command and paste it into the Run dialog, Terminal or PowerShell.
Paste it, press Enter, and you have installed the malware yourself. That is the whole trick: no vulnerability is exploited, the user is persuaded.
The one rule that tells them apart
A real verification screen never asks you to open Run, Terminal, Command Prompt or PowerShell and paste a command. If it does, it is not a verification screen.
Attackers work through urgency; leaving no room to think is part of the method.
How the sites are taken over
Some campaigns run through advertising networks. Others go straight at the sites: in May more than 700 education and technology sites were used this way.
The method there was a known SQL injection flaw, used to steal an administrative API key, after which JavaScript was quietly injected into the site's posts and pages. Visitors trust the site because it really is that site.
The lesson for site owners is that keeping your own server patched is not enough. Where your administrative keys sit, and who could reach them, matters just as much.
Sources: Ars Technica, Malwarebytes.
