How To Protect Yourself Against ClickFix Scams

Hi this is Gary with MacMost.com. Let’s talk about how to protect yourself against ClickFix scams. So today almost all malware gets on computers through some use of social engineering. In other words somebody has to trick you to do something to install malware  It could be as simple as a download masquerading as legitimate software and then you download it thinking you are getting one thing and you’re actually getting another.  So like with all social engineering attacks the weakness there is you. You're being used to bypass any security on your computer to install the malware .

Now ClickFix is an increasingly common type of social engineering attack. What it is doing is having you take some malicious code and you actually executing it yourself inside of an app like Terminal. Now it sounds like it would be hard to actually trick somebody into doing that, but by using psychology and relying on big numbers like sending this out to millions of people or having lots of people visit a website they can usually get a small percentage of people. Let me show you how ClickFix works

Now let’s say you’re browsing a website and you get a typical little alert asking you to prove you’re human. Lots of websites use this to prevent the website itself from being attacked or overused by automatic bots and processes and things. Usually you’re just entering in some characters or identifying fire hydrants, something like that. But in this case it asks you to do something a little bit unusual.  This usually starts with you clicking a button or performing some action that will copy some malicious code to your Clipboard. Then it is going to trick you into running the Terminal app or a similar app.  So you may just use Command Space with Spotlight search for terminal and then press Return. Then using a simple Command V will paste in the malicious code and a Return will execute it. You’re essentially bypassing a lot of protections because you’re actually pasting in code into Terminal and executing it yourself. Nothing automatic is being done here.  You’re actually the one asking your computer to do something very specific.  So it’s just obeying your commands sometimes masquerading as a verification dialogue. You’ll actually get something that is trying to help you. Maybe you’ve searched for a solution to something and you find a webpage that’s providing that solution.  The solution is to copy some code, paste it in a terminal and run it. Here’s what one of these may look like. It may not actually ask you to copy anything because it already copied the code to the clipboard. A previous action you did on the page did that and now it is just asking you to run, in this case Script Editor, instead of Terminal. Paste the code into running there and run it.  This can also execute things at the system level.  It may prompt you for permission to do so. But if you’ve gone this far you’re probably just going to click okay and let it do that. But the idea here is you may desperate. Maybe your Mac is telling you the drive is full and you just need to get something done right now and it’s not letting you do that or having some other issue, so maybe it’s a made up issue on a Webpage.

So you’re doing a web search and you’re coming up with a page that’s providing is offering a solution and you’re desperate for that solution. So you continue with your work or whatever it is you’re doing.  That’s what’s allowing it to catch you off guard and do something you may normally be suspicious about.

Here’s what I found that is live and in the wild. I got to this webpage by just doing a Google search. Now when you go here right now Safari is actually smart enough to give you a warning about this. So hopefully you’ll stop right here. But at some point this was a new site and this warning wasn’t there yet.  The same can be true for other sites or just a copy of this exact website. I’m going to skip past this just to show you what it looks like. It pretends to look like a page at Apple. If you’re not paying close attention to the URL at the top you may think you are actually at Apple's site here. Then it is asking you to do the things I just talked about. It is asking you to launch terminal. In this case it’s doing that first. Then it is asking you to go back here and copy the script. You can’t tell what this is here very easily. But it is actually just a URL to a website and it’s going to download what’s at that URL which is malware, and then it is going to run it. But the webpage is going to happily continue that it is something else telling you it’s something that can solve a problem on your Mac. Not true at all!

If you find these videos valuable consider joining the more than 3000 others that support MacMost through Patreon. You get exclusive content, course discounts, and more. You can read about it at macmost.com/patreon.  

I was easily able to make some examples of some benign code just to show you how this works. This first dialogue here just asks you to verify something by performing these three simple steps. I’m going to click copy here and it copies the code to the clipboard. If you look down at the bottom you could see the code that's being copied, and you can see it’s obfuscated. You can’t tell what it is. Then it’s asking you to press command space, type terminal and press Return. So, I’m going to do that and then you can see it’s asking me to do Command V and it pastes in what was copied there.  Then Return.  In this case my benign code just prints out some words. But there could be some very malicious things there instead.

Now here’s another example. Just two simple steps.  This first step is using a special URL that is going to launch an app on your Mac called script editor. Script Editor can execute Apple’s script and deliver a malicious payload. I’ve got something benign setup for this. If I click it there it’s going to ask me if I want to open Script Editor. So I may not be suspicious at all. Now it brings up Script Editor and inserts the code here. Now it is just some benign code but could be anything here instead. Script Editor now in Mac osTahoe 26.5.2, maybe an even earlier version gives you a warning about this.  Now it would be easy to ignore the warning, li knew script like that and then perform the next step which is simply Command R to run the code.

Now why does this work at all? Well it relies on two things. First of all very large numbers. It’s not targeting a specific person.  If you see one of these on a webpage, well it’s not targeting you. Millions of people are seeing it. So they are just hoping that a few people will actually fall for it. Then, of course in addition to that it’s lying.  It’s saying it needs to verify to let you continue on the website or this is going to help solve your problem. It reminds you of what it is doing. Now, if there is an urgency attached to that then that’s where people fall for it because if you desperately need to get the information on the other side of this or you desperately need to solve a problem, you’re in a rush, you’re tired and you’re not thinking, maybe the situation is just setup right at the moment that you don’t see the warning signs then you could be one of those few out of millions of people that fall for it that day.  It is important to realize that this could happen to anyone and it is very easy to be put in a situation where you’re not suspecting it at the moment, you’re in a rush and you’re not thinking things through. Of course you want to be worried about whether or not you’re copying things to your clipboard. But it is not always very easy to tell if a webpage is doing this.

So a more common thing to look for is if it is asking you to run some other app, usually using Command Space or any other method to launch an app.  That could be Terminal, could be Script Editor, also Automator and Shortcuts are other apps that can run malicious code if you’re not careful. So look out for those four apps.

I order for this to work most of the time you need to actually paste the code in so look out for any instructions on the webpage that tell you to use Command V or Edit Paste.  Then pay attention to any warnings you get. Right now Apple looks at any code that you copied from a website and pastes into Terminal and gives you a warning if it thinks it is malicious. The same is true for Script Editor. Pay attention to those warnings as well. Remember this can come not just from a web bot, but it can also be an ad on the website. In other words the website is legitimate but the ad has slipped through the advertising network that is tricking you into thinking it is part of the site. You are clicking on something there that is setting up the steps that lead to a ClickFix attack. Also you can be getting an email message, or a text message, or a message over any other system where you can possibly get spam that is also leading you.

Now that you have learned a little more about ClickFix scams it will be easier for you to avoid them. Education is the most important thing here so tell your friends and family members about these kind of scams too and hopefully they will stay protected as well. Thanks for watching and stay safe.