Gizmodo Readers Hit With Fake CAPTCHA ClickFix Attack

Gizmodo confirmed over the weekend that one of its accounts had been compromised, and that for a brief window on Saturday the site was serving its readers fake CAPTCHA prompts. The prompts asked visitors to copy a command and paste it into their terminal, which is the entire ClickFix playbook: convince the victim to run the malware themselves so the browser never has to.

Screenshots from readers showed the usual ClickFix dressing, a tidy little verification window, an instruction to open Run or Terminal, a command waiting on the clipboard. Anyone on Windows who followed through ended up with NetSupport RAT on their machine.

An ErrTraffic affiliate, by the looks of it

Proofpoint researcher Tommy M attributes the campaign to an affiliate of ErrTraffic, a ClickFix-as-a-service operation. The model is exactly what it sounds like: the operators run the delivery infrastructure, the affiliate picks the payload. In this case the payload was NetSupport RAT, a remote access tool built on top of the perfectly legitimate NetSupport Manager software. Darktrace has noted previously that it is comfortable lifting files off a host and pulling down further payloads, ransomware included.

Mac users were spared, though not through any kindness on the attackers' part. The macOS payload was configured but broken. The ZIP archive needed a password the victim was never given, so the chain dead-ended before anything ran. Small mercies, as they say.

A short window, a trusted brand

Gizmodo says the malicious script was only live briefly before the site was pulled offline, the injected code removed and the compromised account locked down. Reader reports support that timeline, with the activity spanning a few hours on Saturday. By Monday morning the site was clean.

The detail worth sitting with is how little it took. One account, one script tag, one weekend afternoon, and a publisher most readers would trust on reflex became the front end of a malware delivery operation. There was no exotic exploit, no zero-day, no clever supply-chain twist. Just an account someone shouldn't have had, and a social engineering trick polished enough that pasting a string into a terminal felt like an ordinary verification step.

Why ClickFix keeps working

ClickFix has had a strong year because it sidesteps almost everything the browser is trying to do for the user. There is no drive-by download to flag, no suspicious attachment to scan, no dodgy installer wrapped in a fake Adobe icon. The browser hands the user a string. The user opens their own terminal. The user runs the string. From the operating system's perspective, the human in the chair just decided to execute a command, which is broadly what operating systems are for.

The interesting consequence is that the defensive surface shifts. The thing standing between a NetSupport RAT and a Monday-morning Windows desktop is whether the person reading Gizmodo over their coffee pauses long enough to ask why a tech news site needs them to paste anything into PowerShell. On Saturday morning, for some number of readers, the answer was apparently no.

Gizmodo has tidied up. The affiliate has presumably moved on to the next compromised account on the list.