ClickFix: A Sophisticated CAPTCHA Attack Exposed

I've spent countless hours clicking through CAPTCHAs without giving them another thought. That's exactly why this one worked so well.

A few days ago, I landed on a Cloudflare verification screen that looked entirely normal. I clicked the checkbox as usual and was immediately presented with an unusual 'verification guide' telling me to open my Terminal, hit Cmd+V, then press Enter.

I had unknowingly copied a malicious command into my clipboard at this point. The attackers used a technique called ClickFix, which relies on tricking users into pasting the payload themselves. This is different from traditional malware delivery, as it doesn't rely on exploiting browser or operating system vulnerabilities.

The attack worked by prompting me to paste the malicious command into my terminal. Once decoded, this would send a request to a remote server, which would then execute a shell script that prompts for admin credentials and begins pulling sensitive information from the system.