ClickFix Attacks

ClickFix attacks are social engineering attacks that try to trick you into running a malicious command on your device. The goal of these scams  is to get you to install malware, which then steals sensitive information, such as passwords and financial information, from your device. 

Typically these attacks start on a malicious webpage that:

  • Shows you a pop-up saying a piece of software on your device ran into an error and you need to copy and paste text into a terminal to fix it
  • Presents you with a CAPTCHA that requires you to copy and paste text into a terminal to verify you’re human

The attack prompts you to copy text from the webpage and run it on your device, often by pressing Windows key + R or opening a terminal window and then pasting the text in. The text, which is often encoded so it is not human-readable, is a command that installs malware on your device.

What to look out for

  • Pop-ups or websites saying you need to fix a document, program, or file by running a command on your device
  • Website or pop-ups that instruct  you to open and then paste text into: 
    • Run
    • PowerShell
    • Command Prompt/Shell
    • Terminal
  • Prompts to perform unusual or unexpected steps to verify you’re human, or to solve or troubleshoot an issue with your device

What to do if you are targeted

  • Be suspicious of any unexpected error notifications
  • If a webpage or pop-up unexpectedly asks you to press Windows key + R or copy text and paste it into a terminal, close it immediately
  • Never paste text from error messages, CAPTCHAs, or other unexpected sources into your device’s terminal
  • If you think you may have fallen victim to a ClickFix attack, alert University Information Security (UIS) by emailing [email protected] and provide detailed information on what happened.

Example

A fake Google Chrome error message. Content of error message provided as text below this image.

Text of example:

“Aw, Snap! Something went wrong while displaying this webpage.
To display this web page correctly, please install the root certificate.
Click the “Fix it” button and follow the further instructions.
Copy the code
1. Right-click the Start button and run “Windows PowerShell” ('Windows
Terminal").
2. Right-click in the console window.
Wait for the operation to complete and reload the page.”
 

Archive