This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.
The attack is basically getting someone to accidentally run malicious code.
- ctrl + R brings up the Windows "run" dialogue.
- the code executes a powershell command that reaches out to a remote server
- if successful, the remote server answers and you have installed a dropper or something.
Really, you should never do _anything_ like this for any website. You don't need to protect yourself. This is sort of equivalent (in the strict metaphorical sense) of getting a call from your bank and they ask you for your banking password: you just never do it, no matter what. Same thing here. You don't ever execute code via the run dialogue to solve a CAPTHCA. Never.
> There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.
I think the concern is the user not knowing they're executing code on their machine.
And as a counterexample: some captchas require you to compute something expensive to prove you're not a llm scraper or whatever. It's normal for captchas to require you to execute code on your machine, it's just usually done within the browser's sandbox.
And anyway, these things are completely incomprehensible to non-technical users.
$dayjob just sent out a corporate wide email saying the same thing... I guess it's starting to go around... it's been a while since I've seen a fake website telling people to eg. disable UAC.
Google is trying to normalize a new "complete the captcha on your phone by scanning a QR code" flow, which I'm sure will be a whole new vector for scams.
Was the site itself actually infected(hacked)? If not, then all you need is adblock (like ublock origin). And that was true for last 20 years.
If website actually got hacked then I don't know of any good solutions. It will be flagged soon or later, and new visitors will be blocked by "Google Safe Browsing". Using something like "Qubes OS" might protect you against attacks based on browser zero-days but VMs don't really protect against ClickFix when people usually share clipboard between host and client VMs.
looking at the source code, the entire phishing page is an iframe created through `srcDoc`. the script itself has no command for Mac users to run, so in my case it just copies "Oops..." to my clipboard - the iframe only loads the first time a user visits the page, after which only a tracking script remains.
it also sets some interesting scripts to your LocalStorage, which are evaluated upon each page load. one of them sends a base64 blob containing your device information to another remote server
I've seen similar before where it wasn't the page itself that injected it - rather it was injected by a compromised/sold extension that has permissions on all pages.
Almost, recently. I bought a new Mac, needed something reliable to carry around. I never had a Mac or anything from Apple before, so I wasn't familiar with how exactly does it work. I knew homebrew existed, I understood it's similar to Linux/Windows in that not all applications are in the store, but wasn't familiar at all with how those are commonly installed.
Here's what I did:
1. Open Safari, the only browser there was.
2. Typed "claude mac download" in the search bar (needed Cowork).
3. Clicked the first link.
4. Copied the command it told me to, instructing me to run it in terminal.
Only now I realize that there's something fishy about the command; it had base64 payload in it. Didn't run it and took closer look on the page - it was a Claude share (which I quickly scrolled over).
I can admit mistakes, but Google, Apple and Anthropic deserve some blame here, too.
- Google: pushed malware link up top, didn't (distinctly, at least) mark it as a paid result and I'd swear it didn't show me the URL (which I usually always check before clicking, but maybe I just missed it as the search results are rendered differently from Kagi's)
- Safari: hides path by default, so all you see is "claude.ai". Someone probably thought this looked nice, I think it's just borderline idiotic.
- Anthropic: hosts what's essentially a user-content on their main domain.
Also recently saw a few legit projects using base64 in their install one-liners. Please, stop it.
> How do you protect yourself ?
Installed not Safari and made Google not my default search engine, as I always do. That way I at least always know where I am.
This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.
The attack is basically getting someone to accidentally run malicious code.
- ctrl + R brings up the Windows "run" dialogue.
- the code executes a powershell command that reaches out to a remote server
- if successful, the remote server answers and you have installed a dropper or something.
Really, you should never do _anything_ like this for any website. You don't need to protect yourself. This is sort of equivalent (in the strict metaphorical sense) of getting a call from your bank and they ask you for your banking password: you just never do it, no matter what. Same thing here. You don't ever execute code via the run dialogue to solve a CAPTHCA. Never.
https://www.sentinelone.com/blog/how-clickfix-is-weaponizing...
> There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.
I think the concern is the user not knowing they're executing code on their machine.
And as a counterexample: some captchas require you to compute something expensive to prove you're not a llm scraper or whatever. It's normal for captchas to require you to execute code on your machine, it's just usually done within the browser's sandbox.
And anyway, these things are completely incomprehensible to non-technical users.
$dayjob just sent out a corporate wide email saying the same thing... I guess it's starting to go around... it's been a while since I've seen a fake website telling people to eg. disable UAC.
Google is trying to normalize a new "complete the captcha on your phone by scanning a QR code" flow, which I'm sure will be a whole new vector for scams.
> How do you protect yourself
Was the site itself actually infected(hacked)? If not, then all you need is adblock (like ublock origin). And that was true for last 20 years.
If website actually got hacked then I don't know of any good solutions. It will be flagged soon or later, and new visitors will be blocked by "Google Safe Browsing". Using something like "Qubes OS" might protect you against attacks based on browser zero-days but VMs don't really protect against ClickFix when people usually share clipboard between host and client VMs.
Not directly answering your questions, but I just wanted to say: Great instincts!
You saw something unusual, then
1. Stopped what you were doing.
2. Investigated to see if this was legitimate or malicious.
3. Identified a place to asked others about it.
4. Formulated a good question with enough background information to help people answer it.
All around good job! Well done.
5. Paste the entire command on HN so the aspiring script kiddies have a launching point. 6. ? 7. Profit!
5. Put the malicious payload directly into work AI system.
"Great instincts!" lmao
looking at the source code, the entire phishing page is an iframe created through `srcDoc`. the script itself has no command for Mac users to run, so in my case it just copies "Oops..." to my clipboard - the iframe only loads the first time a user visits the page, after which only a tracking script remains.
it also sets some interesting scripts to your LocalStorage, which are evaluated upon each page load. one of them sends a base64 blob containing your device information to another remote server
Do you have any browser extensions enabled?
I've seen similar before where it wasn't the page itself that injected it - rather it was injected by a compromised/sold extension that has permissions on all pages.
Reporting to https://safebrowsing.google.com/safebrowsing/report_phish/, which if their tests reproduce the problem will make most browsers unwilling to load the domain. Generally ether caused by a hacked CMS or bad advertisement.
VT says no bueno: https://www.virustotal.com/gui/url/4812564b97c63e1607e9182d0...
fine-work-team.com has been reported as suspicious. Cloudflare is blocking it now.
> How do i protect myself from these scams / hack attempts in the future
Endless vigilance. Scammers are always working on new tricks. You were rightly suspicious and not fooled by this one.
> Has this happened to you before ?
Almost, recently. I bought a new Mac, needed something reliable to carry around. I never had a Mac or anything from Apple before, so I wasn't familiar with how exactly does it work. I knew homebrew existed, I understood it's similar to Linux/Windows in that not all applications are in the store, but wasn't familiar at all with how those are commonly installed.
Here's what I did:
1. Open Safari, the only browser there was.
2. Typed "claude mac download" in the search bar (needed Cowork).
3. Clicked the first link.
4. Copied the command it told me to, instructing me to run it in terminal.
Only now I realize that there's something fishy about the command; it had base64 payload in it. Didn't run it and took closer look on the page - it was a Claude share (which I quickly scrolled over).
I can admit mistakes, but Google, Apple and Anthropic deserve some blame here, too.
- Google: pushed malware link up top, didn't (distinctly, at least) mark it as a paid result and I'd swear it didn't show me the URL (which I usually always check before clicking, but maybe I just missed it as the search results are rendered differently from Kagi's)
- Safari: hides path by default, so all you see is "claude.ai". Someone probably thought this looked nice, I think it's just borderline idiotic.
- Anthropic: hosts what's essentially a user-content on their main domain.
Also recently saw a few legit projects using base64 in their install one-liners. Please, stop it.
> How do you protect yourself ?
Installed not Safari and made Google not my default search engine, as I always do. That way I at least always know where I am.
> showed showed
pinged one of the authors on bsky, let's see
It’s a typical technique, report it to safe browsing, upload it to VirusTotal, that should be tit flagged quickly