This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.

The attack is basically getting someone to accidentally run malicious code.

- ctrl + R brings up the Windows "run" dialogue.

- the code executes a powershell command that reaches out to a remote server

- if successful, the remote server answers and you have installed a dropper or something.

Really, you should never do _anything_ like this for any website. You don't need to protect yourself. This is sort of equivalent (in the strict metaphorical sense) of getting a call from your bank and they ask you for your banking password: you just never do it, no matter what. Same thing here. You don't ever execute code via the run dialogue to solve a CAPTHCA. Never.

https://www.sentinelone.com/blog/how-clickfix-is-weaponizing...

> There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.

I think the concern is the user not knowing they're executing code on their machine.

And as a counterexample: some captchas require you to compute something expensive to prove you're not a llm scraper or whatever. It's normal for captchas to require you to execute code on your machine, it's just usually done within the browser's sandbox.

And anyway, these things are completely incomprehensible to non-technical users.

but people pipes a shell script from a URL to bash all the time. with enough practices, it becames second nature.

I make it a rule never to give confidential information to an incoming call. I had a primary doctor whose office would send notification calls immediately asking for part of my social security number, I always hung up.... I figured out it was for the doctor later, and commented that it was ridiculous and I wouldn't ever receive any such notifications.

Just that simple practice has kept me reasonably safe, even from an AI scam once.

$dayjob just sent out a corporate wide email saying the same thing... I guess it's starting to go around... it's been a while since I've seen a fake website telling people to eg. disable UAC.

If one user makes the mistake, it would be fair to blame them.

Because thousands of users make the same mistake, blame needs to be directed at Windows UX.

MS could fix this easily by 1) moving Run to optional features and 2) removing online features from Start to make performance comparable.

The other "run" interfaces (terminal, conhost, Powershell) are sufficiently menacing to scare away non-devs already.

I've seen sites with similar fake captchas posted twice in the last month by old time regular users. My guess is that the sites were infected after they saw and decide to post it here.

As a workaround, is it possible to disable Ctr+R to add some friction in case I am distracted?

> There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.

Oh yeah? What about Google saying “install the reCAPTCHA app in the App Store” <https://reclaimthenet.org/google-broke-recaptcha-for-de-goog...>?

It’s absurd, but these nominally-security tools frequently genuinely train users to become susceptible to attacks.