A phishing campaign is targeting GitHub users with phony CAPTCHA pages, according to researchers at McAfee. The phishing emails ask users to address a security vulnerability in a GitHub repository that they recently contributed to, and contain a link to find more information about the alleged vulnerability. This link leads to a fake CAPTCHA page that attempts to trick them into installing malware.
“The ClickFix infection chain operates by deceiving users into clicking on buttons like ‘Verify you are a human’ or ‘I am not a robot,’” the researchers write. “Once clicked, a malicious script is copied to the user’s clipboard. Users are then misled into pasting the script after pressing the Windows key + R, unknowingly executing the malware. This method of trickery facilitates the infection process, making it easy for attackers to deploy malware.”
Users should be extremely suspicious of any site that asks them to press the Windows key + R, as this will open a “Run” prompt on their computer. You should never enter code into a Run prompt without understanding exactly what it does, and a legitimate CAPTCHA test will never require this level of access.
McAfee offers the following recommendations to help users avoid falling for these attacks:
- Conduct regular training sessions to educate users about social engineering tactics and phishing schemes.
- Install and maintain updated antivirus and anti-malware software on all endpoints.
- Implement robust email filtering to block phishing emails and malicious attachments.
- Use network segmentation to limit the spread of malware within the organization.
- Ensure all operating systems, software, and applications are kept up to date with the latest security patches.
- Verify URLs in emails, especially from unknown or unexpected sources.
- Restrict clipboard-based scripts and disable automatic script execution.
- Keep antivirus solutions updated and actively scan.
- Educate users to avoid suspicious CAPTCHA prompts on untrusted sites.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
McAfee has the story.
