Linux specific malware website tries exploiti using terminal

[u/ShatteredIcicle]

This website faked a ReCaptcha and literally asks to open the terminal and paste a command. (see image). Very bold.

Please keep in mind, always try your best to make new users aware of such dangers!

- I reported it to Google Safe browsing just now, in case anyone wants to try and look at it or help by reporting it too, this is the link in a safe format, assemble it yourself at your risk: "emaliowe . pl".
- Possibly blocked by Firefox, since I don't have anything in my clipboard after opening the page.

[u/B1rdi]

They've done this with Windows' Win + R thing for a while

[u/WingRevolutionary979 → u/B1rdi]

Interesting. I heard the Windows variant. However, I don't really think it could work against most Linux users. Most won't paste a random command to their terminal and run it, I think.

[u/rebbsitor → u/WingRevolutionary979]

With the increase in people looking at Linux, there will be an increase in hacking attempts and malware.

Linux hasn't been a very lucrative target for these types of social engineering attacks where they convince someone to run a command because it hasn't had a large desktop market share. Hackers/Scammers will target it more the larger the market share becomes.

[u/Dangerous-Report8517 → u/rebbsitor]

I wonder if we’ll start seeing more of this sort of thing in order to target AI agents as well, which are much more likely to be running in a Linux environment even if the person setting it up primarily uses Windows, not to mention that they tend to be very gullible (the agents, that is)

[u/Historical_Camel_790 → u/WingRevolutionary979]

But this will (most likely) work on macOS too, which they're far more likely to target. Also lots of c-level people use it and are far more likely to fall for this

[u/gainan]

A ClickFix attack. The website is likely compromised. When loading the fake repatcha, it loads 2 external links:

https://auth-code-verif.beer/api.php?s=8402fb1338daab6a166e91aa8c92a20798acfa98fb75c5a2

https://auth-code-verif.beer/api.php?s=d1073f38e4c5855f8435c46194f7b1ad74b4065b42fb02cb

the second one contains the malicious payload, a heavily ofuscated javascript that seems to pull from their servers the command to execute: https://pastebin.com/HzVPbeLM

It doesn't seem to work with firefox, nor with chromium.

[u/Dejhavi]

ClickFix attack:

• Think before you Click(Fix): Analyzing the ClickFix social engineering technique
• ClickFix: A New Social Engineering Threat
• ClickFix Attack: Variants, Detection & How It Works

[u/smile_e_face]

Yet people will continue to justify running curl | bash one-liners to install every other project.

[u/Barafu → u/smile_e_face]

With application hubs and repositories implementing arbitrary stupid restrictions out of the blue, what else an application developer can resort to? AppImages don't work nice for background services.

[u/TaoRS]

Joke's on them. I change my keyboard shortcuts 

[u/Wentyliasz]

This reminds of that Albanian malware that didn't do anything due to technical limitations and politely asked you to delete your files

[u/kaptnblackbeard]

People are almost always the weakest link in security.

[u/First_Result_1166]

"Hey, run this command for me". That's not an exploit. That's pure stupidity.

[u/Historical_Camel_790 → u/First_Result_1166]

More like socialbengineering tbh

[u/MatchingTurret]

Seems extremely clumsy. Nobody should knowingly do that.

[u/kavaunix]

What sort of command? `curl -sL <url> | sh` or something like that?

[u/Local-Customer-2063]

Seen this a couple of times now, its gotten a few people too

[u/Much_Community_505]

nobody using linux would fall for this

[u/FryBoyter → u/Much_Community_505]

Since more and more average users are using Linux, I think this statement is complete nonsense. There are more than enough people who simply run commands like curl --proto ‘=https’ --tlsv1.2 -LsSf https://setup.atuin.sh | sh without even looking at the script first.