Lumma: fake CAPTCHA
Lumma Stealer profileAccording to CISA and FBI, the fake CAPTCHA asks the user to open the Run dialog and paste the command from the clipboard; pressing Enter starts a Base64-encoded PowerShell process. CISA and FBI (AA25-141B)
A social engineering technique that uses a fake error or verification window to get users to copy and run a malicious command on their own computer.
According to Proofpoint, ClickFix uses dialogue boxes with fake error messages to trick people into copying, pasting and running malicious content on their own computer. Proofpoint
MITRE ATT&CK defines this behaviour as the “Malicious Copy and Paste” sub-technique: fake error or CAPTCHA prompts ask the user to open a terminal or the Windows Run dialog and execute a command. MITRE ATT&CK
A compromised site, document or email attachment opens a fake error or “verify you are human” window. Proofpoint
When the button is pressed, the malicious command is silently written to the clipboard. Proofpoint
Following the instructions, the user pastes the command into the Run dialog or a terminal. MITRE ATT&CK
PowerShell downloads and starts the actual malware. CISA and FBI (AA25-141B)
According to CISA and FBI, the fake CAPTCHA asks the user to open the Run dialog and paste the command from the clipboard; pressing Enter starts a Base64-encoded PowerShell process. CISA and FBI (AA25-141B)
Proofpoint reported that ClickFix campaigns led to malware such as AsyncRAT, DanaBot, DarkGate, Lumma Stealer and NetSupport, and that the technique is used both by financially motivated actors and by suspected espionage groups. Proofpoint
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy