Last month, visitors of the popular site Reddit thought they were clicking on a legitimate HBO ad promoting its macOS app and three months of free service. After clicking on the ad, users received a prompt with instructions to download the app. What they didn’t know was scammers had taken over HBO’s official Reddit account and created fake ads to lure unsuspecting users to a false HBO site to install malware on their devices.
What happened on Reddit is a ClickFix scam, and they’re an easy way for criminals to make you hack yourself while they sit back and steal your data.
What is a ClickFix scam?
ClickFix scams are a form of social engineering where you do the work for the hacker. A bad actor sends you a fake prompt that either asks you to verify your identity or offers some kind of guidance. It may look like a CAPTCHA, error message, or a pop-up directing you to fix something on your computer:
Example of a ClickFix prompt. (Source: Huntress.com)
Then, you’re asked to copy and paste a command into Windows Run or Mac Terminal. Without touching your computer, the scammer is using you to enter malicious code into your own device and take control.
Don’t do their dirty work!
If you see an unexpected prompt, look for these clues indicating it may be a ClickFix scam:
- Request to copy and paste commands: Never open your computer terminal and enter a command!
- Prompt gives you step-by-step instructions: Any prompt that asks you to press a combination of keys (see image above) may be a scam.
- Asks you to download software: Only install software from the official source, not a prompt.
- Makes you execute commands to prove you’re human: Real CAPTCHAs and websites don’t need you to do anything with your system commands to verify your identity.
And remember: ITS will never send you a prompt asking you to open a terminal to fix an error on your computer. If you suspect you may have received a ClickFix scam, contact the Service Desk immediately!
October is National Cybersecurity Awareness Month, an annual collaborative effort between government and industry to ensure we have the resources you need to maintain your security online. Throughout October, we’ll be sending you tips on protecting your information and avoiding malicious attempts to extract your personal data. Visit its.weill.cornell.edu/cybersecurity for more info.