Social engineering scam ClickFix using websites to spread malware
We have received reports a social engineering lure known as ClickFix is infecting users’ devices with malware.
What’s happening
We have received reports that a social engineering technique known as ClickFix is being used to infect users’ devices with malware.
Infected websites are presenting users with fake attempts to verify that you are human. These are usually fake CloudFlare, CAPTCHA or reCAPTCHA pages.
What this means
When visiting an infected website, users are prompted to follow nefarious instructions that result in their device being infected with malware.
There are several different kinds of malware with which visitors can be infected.
What to look for
Real CloudFlare, CAPTCHA and reCAPTCHA systems will never ask you to use keyboard commands or copy and paste content instead of a standard puzzle or checkbox (such as the “click all the boxes with traffic lights” puzzle, or the “I am not a robot” checkbox).
CloudFlare, CAPTCHA and reCAPTCHA will also never ask for passwords, login credentials, or personal information. The legitimate versions of these systems are embedded directly into the webpage. If a verification prompt appears as a sudden pop-up window it is likely fraudulent.
What to do
If you have been to a website where it instructs you to use keyboard commands, or copy and paste content, or enter sensitive information on a CloudFlare or CAPTCHA page, immediately close the tab or the browser without following any of the commands.
If you think your device has been infected with malware, there are steps you can take to remove it. See our guide below for more information.
Remove malware from your device
If you are running a website and discover that it is infected with ClickFix, you should:
1. Take your webpage offline
2. Confirm whether your page is infected
3. Remove the malicious scripts
4. Remove any malicious persistence
5. Verify your site is free of malicious content
6. Communicate to affected users.
Removing ClickFix requires some technical knowledge, if you do not feel comfortable removing it yourself, we recommend you immediately take the site offline, reset your login details and then contact a local IT service provider to assist you.
More information
Own Your Online offers helpful guidance on how to stay protected.
For more detailed in-depth information on this scam, check out the alert on the NCSC website(external link).
If you require more information or further support, submit a report on our website or contact us on 0800 114 115.