A local heat pump installer in my area has a compromised website that has a malware/phishing approach via CAPTCHA that I've not seen before.
Update: jrn tells me this is a ClickFix Attack. Cyber Security News have a good write up for those wanting to know more.
The site is a compromised WordPress installation. On load the page briefly renders fine, but then brings up a CAPTCHA styled to look like Google’s reCAPTCHA.
The initial request for the user is reasonable enough:
Just completing a checkbox seems fine
The second request however, is considerably less reasonable!
Pretty suspicious!
This is asking for the user to paste unknown commands to their terminal. That’s a very bad idea, and 100% not how Google would ever ask someone to prove they’re a valid site visitor. The site does a simple browser fingerprint to show you operating-system-specific instructions, so those with Windows see shortcuts and commands that rely on PowerShell for example.
Annoyingly (or fortunately?) the clipboard was empty of content when I visited, so I’m not quite sure what the next step would have been. jes reckons it would be a script to search the local machine for LLM or crypto keys. Feels believable.
I thought this was interesting though, as in general CAPTCHAs are getting more sophisticated/harder1. We’ve got a lot more bot traffic online than we used to, at least using Cloudflare’s metrics to compare recent time periods2, so perhaps we are likely to see more unusual but genuine CAPTCHA requests in the future, which in turn makes opportunities for scammers?
A final thought here. Even if we could trust the source, would pasting arbitrary commands into a terminal ever make sense for human vs. bot detection? I guess it would let a site run commands to fingerprint the machines in a more thorough way than the browser environment exposes. It wouldn’t be the endgame though. The aim is for CAPTCHA to test the user, not the machine - CAPTCHA standing for ‘Completely Automated Public Turing test to tell Computers and Humans Apart’.