How to get your computer infected and hacked in three easy steps!

[thewayne]

There's a new hack that has become widespread. It's actually been around for a while, it was previously kind of tightly targeted. But now you can compromise a web site and install this crap and you have a good chance of infecting all sorts of people who stop by!

It starts looking like a form of CAPTCHA: prove that you're a human. It wants you to do three things:
1. Press the Windows button plus R
2. Press Control-V
3. Press Enter.

What you've just done is open a command prompt and pasted some code that the compromised web page has placed inside your computer's paste buffer. That code installs a remote-access toolkit (RAT), key capture program(s), things to further compromise your PC's security, etc. You no longer own your computer.

Things like this is why we can't have nice things. You'll most commonly see these on lookalike web sites impersonating known sites through typosquatting, etc.

https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/

(yes, I'm cleaning out browser windows)

Comments

[conuly]

Ooof, thanks.

[thewayne]

A bit insidious for the unwary.

[disneydream06]

Thanks for the heads up on this. :o
Hugs, Jon

[silveradept]

Guh. Another malware attack that's intended to take advantage of the fact that corporations have trained us to do things for them that don't have benefit to us. If, perhaps, there wasn't such a ubiquity of (ineffective) CAPTCHAs about, then we wouldn't be as susceptible to an attack that basically takes advantage of us going "ugh, this must be some new ineffective way of blocking me that I still have to do."

[thewayne]

The one thing that I should have specified in this post is that this attack only affects Windows users.  But still, yeah, you're right.

[silveradept]

Yeah, it only affects Windows users, but that just means it only affects, what, 99% of everyone instead of 100%? The world still runs on Windows, so.