Hackers are using fake Cloudflare 'prove you're human' pages on hacked websites to get visitors to run a harmful command on their own computers.
A fake website check is fooling people into attacking their own computers. Researchers found hackers copying Cloudflare's 'verify you are human' pages on websites they have already broken into. The page then asks visitors to run a command, and that hands the hackers a way in.
Cloudflare is a service that many websites use to handle their traffic. It is so common that when it has gone down, a large part of the internet went with it. Hackers know that people trust its check pages, so they copied one.
Researchers at the SANS Technology Institute's Internet Storm Center found the attack. It is a type of scam called ClickFix, which relies on tricking a person rather than breaking into software.
A visitor lands on a compromised site and clicks the fake verification box. The page then says the check is taking longer than usual. To speed it up, it tells the visitor to follow on-screen directions and run a specific command.
That step is the attack. The visitor is the one who runs the command, and it can download malware or give the hacker access. No software flaw is involved, and no file is downloaded first. That is why it can slip past people who are careful about attachments.
The page shows different instructions for Windows PCs and Macs. The report also lists requests that appear meant to track details such as the visitor's location and IP address. The attack has appeared on multiple compromised websites.
Anyone who browses the web on a Windows PC or a Mac could meet this page. Because it sits on hacked sites, it can show up somewhere you already trust. Business owners should pass the warning to staff, since one person following the prompt on a work computer could expose more than their own files.
The alert box above lays out the steps. The short version is that a real human check only asks you to click a box or solve a CAPTCHA. It never asks you to open a terminal or a Run box, so close the page if it does.
The report does not say how many people have been affected, which sites were hacked, or who is behind the campaign. It also does not say what the command does beyond downloading malware or giving the hacker access. Check back for updates as the researchers share more.
A real 'prove you're human' check never asks you to paste a command, so close any page that does.
Voters in Upper Sandusky, Ohio, banned large data centers after a $900 million plan. Here is how a town of 6,600 did it, and what other places can learn.
Read more: Small Ohio town votes to ban a $900 million AI data centerIn a hand-counted 4,500-step walk, the $180 Fitbit Edge was off by 8 steps and the $800 Apple Watch Ultra 4 by 51. Both did the job well.
Read more: A $180 Fitbit counted steps more closely than an $800 Apple WatchThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
