|
Originally Posted By ScubaDachshund: Do not do that. That sequence brings up the Run box and pastes something in it. You hit run and it does whatever you pasted in there. Sounds malicious or at least suspicious to me. Social engineering at it's worst. Trick the user into slitting their own throat. |
|
I asked BraveAI, and this is what came up: The prompt to press Windows + R, then Ctrl + V, and finally Enter is a malicious scam known as the ClickFix attack, not a legitimate Cloudflare verification. Legitimate Cloudflare challenges never require users to run local system commands. The scam works by stealthily copying a malicious PowerShell script to your clipboard when you visit the compromised website. When you paste this script into the Windows Run dialog, it executes code that downloads and installs malware, such as info-stealers or Remote Access Trojans (RATs), which can steal passwords, cookies, and financial data. To stay safe: Never follow instructions on a website asking you to run commands via Win + R. If you suspect you executed the script, immediately disconnect from the internet, run a full scan with Windows Defender or another antivirus, and change all your passwords. Genuine Cloudflare verification involves a simple checkbox or CAPTCHA within the browser, with no external commands required. |
Joined:
May 2026
Posts:
1312
EE: 0% (0)
FL, USA
|
Originally Posted By madmathew: https://www.ar15.com/media/mediaFiles/108155/Cloudflare_screen_jpg-3807213.JPG Websites are now using "if you don't look normal you'll get stopped by the bouncer at the door and frisked." Yeah ... do NOT EVER do any windows key plus anything, esp windows + r - that runs whatever you enter after that. So it looks like someone is trying to do scam versions of the bot challenges now. *facepalm* Added ... and into my hostsfile to block it goes. |
|
Originally Posted By lygxis: The internet is absolutely over-run with automated bots that do nothing more than go to websites to copy the content of the website - that has been a problem for decades, but now that AIs use copies of all of the text of the entire internet https://en.wikipedia.org/wiki/Common_Crawl it's gotten very bad, they're stealing everything they can get their claws on. Websites are now using "if you don't look normal you'll get stopped by the bouncer at the door and frisked." Yeah ... do NOT EVER do any windows key plus anything, esp windows + r - that runs whatever you enter after that. So it looks like someone is trying to do scam versions of the bot challenges now. *facepalm* Added ... and into my hostsfile to block it goes. Originally Posted By lygxis: Originally Posted By madmathew: https://www.ar15.com/media/mediaFiles/108155/Cloudflare_screen_jpg-3807213.JPG Websites are now using "if you don't look normal you'll get stopped by the bouncer at the door and frisked." Yeah ... do NOT EVER do any windows key plus anything, esp windows + r - that runs whatever you enter after that. So it looks like someone is trying to do scam versions of the bot challenges now. *facepalm* Added ... and into my hostsfile to block it goes. Cloudflare is legit. They help websites with things like DDOS attacks which this website uses. They're actually one of the biggest providers of tools that help run the internet. The Cloudflare "real human check" is actually a good thing and way less annoying than some of the captchas some sites use. This particular attack is not new. They're impersonating Cloudflare to get people to run malicious code that deposits malware on their PC. Someone mentioned the Click Fix attack which is basically what this is. |
| I had to login to my company's pension manager website. I was off by one letter and got that. It will install malicious code on your machine. Most likely infostealer malware that would feed all your passwords back to the hackers running the scam. |
dfwlabrescue.org
|
Originally Posted By cruze5: REALLY need to consider using a product like nextdns or controld to block those domains. I highly recommend changing DNS at the router level so every device that gets DNS from the router uses what you set it to. You can also change it at the device level (encrypted) but people would have to look up the instructions for their OS and DNS combo. I personally use Quad 9 9.9.9.9 / 149.112.112.112 as the primary. A lot of people don't realize Cloudflare has multiple DNS products. 1.1.1.1 is their standard DNS but they also have: Malware Blocking Only Primary DNS: 1.1.1.2 Secondary DNS: 1.0.0.2 Malware and Adult Content Primary DNS: 1.1.1.3 Secondary DNS: 1.0.0.3 You can also set something like Quad 9 as the primary and Cloudflare 1.1.1.2 as the secondary. If one goes down it will revert to the secondary. |
