Google is updating Chrome Enhanced Protection to warn people when scam websites try to trick them into copying and running harmful commands. These ClickFix scams use fake computer problems, such as bogus browser or antivirus alerts, to move victims from the browser into a terminal where security download protections may be bypassed.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A website says your browser is broken. Its fix? Open PowerShell. That's ClickFix: a fake browser or antivirus alert tells you to copy a command. Here's the catch: what lands on your clipboard can differ from what the page shows. Paste it into PowerShell or cmd.exe, and it can download malware outside Chrome's normal download protections. Chrome Enhanced Protection may warn you, but that's a safety net. If a website asks you to run a command as a fix, close the page and report it to IT.
Attackers are using a fake “I am not a robot” style ClickFix prompt to persuade Siemens Software Center users to paste attacker-provided commands into Windows. If users comply, the attackers can exploit a DLL side-loading flaw to run malware alongside a genuine, signed Siemens application.
This article describes ClickFix attacks in which fraudulent or compromised websites display fake technical warnings and persuade visitors to copy and run harmful commands. The scam may claim a browser update, failed security check, or urgent technical repair is needed, then directs the user to use…
Researchers uncovered a long-running “SEO poisoning” operation that manipulates Bing search results to push people onto fake support and activation pages. Victims are steered through a chain of redirects to either download a malware-laced ZIP (MayaBot) or be pressured into calling a fake…
Google is adding Chrome warnings to help stop ClickFix scams, where criminals persuade people to copy and run harmful commands under the guise of fixing a routine browser or verification problem. The scams commonly use fake Cloudflare or Google reCAPTCHA pages, then direct victims to paste a…
Attackers are using fake calendar invitations to bypass normal email defenses and lure people into credential theft or malware downloads. The invites may appear in a user’s calendar even when the related phishing email is quarantined, making unexpected meeting entries a new route for account and…
Researchers found ROMULUS, a malware-delivery platform that uses fake web pages and ClickFix-style prompts to persuade people to run harmful commands themselves. The platform can deliver Legion Loader and other malware through a PowerShell script, showing how a seemingly routine verification or fix…
