Hackers are impersonating Cloudflare in a new social-engineering campaign designed to trick internet users into granting them unauthorized access to their computers. The attack abuses the familiarity of Cloudflare verification pages, which websites commonly use to confirm that visitors are human rather than automated bots.
The campaign was identified by cybersecurity researchers at the SANS Technology Institute’s Internet Storm Center. It targets users through websites that have already been compromised. After a visitor clicks what appears to be a genuine Cloudflare verification box, the page claims that the process is taking longer than usual and instructs the user to run a command to speed it up.
That request is the key to the attack. Rather than exploiting a software or hardware vulnerability, the ClickFix campaign relies on social engineering to persuade victims to copy and execute malicious commands themselves. Those commands can download malware or give the attacker access to the device.
The instructions shown can vary depending on whether the visitor is using a Windows PC or a Mac. The reported commands appear to be designed, among other purposes, to collect information such as the user’s location and IP address. Researchers said the attack has been deployed across multiple compromised websites.
Users should be familiar with standard verification steps, such as selecting a verification box or completing a CAPTCHA. However, a legitimate human-verification process should not require visitors to open the terminal or the Windows Run box and execute commands.
Sources: Mashable.