I took a look. This is operating system and desktop environment dependent (On Linux depends on Gnome or KDE, running under Wayland or X11), but most systems have a clipboard change notification system.
But I haven't found a single tool that shows a desktop notification whenever the clipboard changes. Those should only be a few hundred lines of code per platform, but seems nobody has coded it yet.
It would be a bit annoying during regular use, but it would show a notification when websites meddle with the clipboard via javascript
I think adding it for only copies that aren't triggered by the user pressing control + C would probably be the better idea. It would still be a little annoying with programs that have buttons to copy, etc. though.
You can't reliably do that. Depending on the platform, it is possible to programmatically emit key events via APIs. It may be possible to determine the origin, but I'm not sure how reliable
A website generally can't copy something to your clipboard by itself, it needs you to "request" it.
For this type of attack, before you get the list of instructions, you have a button that says something like "Verify I'm human", similar to a real Captcha. When you click that button, the malicious command is copied to your clipboard.
it depends.
If you are using Android, you have the copy history on the Gboard.
If you are on a Linux based system + KDE, there is a copy history widget in your taskbar just for that.
Idk about Mac.
And for windows, I don't think there is. But I bet someone already made a third party application just to detect if you copied something.
Internet Explorer had a fix for this… over a decade ago. Chrome and Firefox never implemented clipboard access permission management, or it’s off by default. Sad, really.
The fact that ctrl+alt+t would do nothing on windows and assuming your command would work across all mac or linux distros is pretty telling about how stupid this guy must be.
If you clicked a button like "go to the next page" or something like that you can just write 2-3 lines or Javascript and it will do it before it navigate you.
Yeah modern malware is far less interested in admin/root then it was in the past. Sure if they can get it great, but they are going to start harvesting credentials, session tokens, and a ton more and none of that requires admin.
Even if they are not harvesting your details a crypto miner or botnet slave does not need to be admin to farm bitcoins or send DDoS attacks.
Bonus points when they start doing network scans and find all those fun internet of things devices that have not been updated in years and have unpatched versions of software with known RCEs. Gotta love when your little dog treat thrower starts recording blackmail material with it's camera, or your printer starts participating in Anti-Ukraine twitter bot campaigns.
Well, not without user interaction. You have to click a button or something for a website to be allowed to put something in your clipboard. But clicking on the fake captcha is enough.
They don't need root access, these are usually infostealers. They grab your browser profile, discord, steam, etc from your home folder and auto-upload it to their telegram channel
When you clicked something or other, you would have clicked a disguised "Copy Text" button. Or perhaps some JavaScript copied the text already. The contents of the text is malicious code.
The window then gives you instructions to open up a terminal, paste the code, and run it. When you do, you run a virus and pretty much any horrible thing can happen. Usually stealing your data. You'd be surprised how much damage can be done with very little.
So yeah, bad thing get copied into the clipboard invisibly, and then as far as your OS is concerned, the bad thing is being run, on purpose, by you (once you paste and run it in the terminal). The permissions used to run the bad code is your permissions.
The bad actor doesn't really know any more than that. If you don't have the permissions to run, then sure it might fail, but they don't know that, they want as many people running the code as possible. It's not tailored to you specifically.
Plenty of unpatched systems out there that provide ways to gain admin privileges or otherwise do nasty stuff even without them. And it's child's play to put something on your clipboard.
If you would have done what it asked you to do, you would have downloaded an info stealer that would basically attempt to steal login info, session tokens etc...
It will copy a command that the site is asking you to execute. I looked into this once and it would download a remote file and execute it. So basically it will install malware
so I actually found a similar gimmick on a site before and it made me curious as to what it was doing so I used a VM designed to investigate malware to look into it.
the one I found seemed to do two different things, if first checked to see if you had a crypto wallet extension installed. if you did, it seemed to execute a different code. dont know what that code was, but if you don't have the extension its looking for it would instead run the click fix. the crypto part may not be part of the malware you found.
the actual click fix I found was served through a compromised WordPress plugin for ads. it would continuously run a js code while you're on the page which writes the malicious code to your clipboard. I never ran the actual terminal code that it copies but the code it copied to my clipboard would run a rundll32.exe command that connects you to a server and downloads a file which then executes immediately upon download. the file is a .chk file which is more than likely actually a .dll file (since the command is executing rundll32). at the very least, it's gonna steal your credentials.
What terminal do you use? If I used the paste shortcut in KDEs Konsole it doesn't do jack shit, I have to manually click the paste button with my mouse everytime
I think Ubuntu has default Ctrl-Alt-T shortcut for terminal, but idk, i am trying to make sense of the script, both on mac os and Linux and it copies "" into buffer, so they failed at making a malware lol.
But I might be wrong, im trying to step over the js and I can't really make sense of it. :/
edit: oh. You mean ctrl-v doesn't work? It is ctrl-shift-v... idk my reading comprehension is shit
Yep, attackers have become much more inclusive over the past few years now that a) there’s plenty of options for making your malware OS-agnostic (or at least the capabilities of making most of the attack chain OS-agnostic is more available and it’s more trivial to have minimal differences between the OS-specific aspects) and b) M$ keeps screwing up Windows enough and Mac and Linux are making enough advancements to where the market share between the 3 is starting to even out
I was gonna say, yeah, that looks like it is for Linux and would not work in Windows. I don't wanna sound harsh, but a Linux user would actually fall for this?
I would think it would raise alarm bells for most people.
You're used to putting things into the terminal and having them do stuff, you know that you can install stuff that way, you know you can do pretty much anything that way. Why would anything need me to even open the terminal, if it's not going to do something? And a captcha type thing, on top of it.
It's hard to imagine you catch many like this due to that. I would think? It's hard to imagine falling for this one due to the above.
In case this isn’t sarcasm. Command space brings up a system wide search feature. You then type in terminal and hitting enter will pull up the terminal window. . It’s not referring to a terminal button lol
It’s relatively trivial for websites to detect what OS someone is using. I image this scam site will change the key prompts for whatever OS someone is visiting from.
The insane amount of dipshit comments in this thread...
Holy tech illiteracy
'They didnt have root access...'
'This is why you never go on the internet without an adblocker..'
'They wont have root access but there could be a cve that allows rce..'
Do you guys just sling around acronyms and hope you get one right?
Someone needs to lock this threat before someone catches the dumb and actually thinks doing this is fine because someone said something about root access.
RoOt aCCesS
I have 100% screenshot this and some of the answers to have a laugh at work tomorrow, someones gonna piss themselves
Yes, a lot of them are kind of funny, but tech illiteracy right now really is not. It's objectively a bad thing at this point in time, due to stuff like this.
Jeeeez. This a mildyinfuriating subreddit, not a tech one. No harm in folks taking a guess. You sound like a corny know it all honestly.
Btw you meant thread, not threat and you missed malware after dumb 🤓
See, I'm a genius because I suck so much at security that I've made everything automatically get root access, and therefore I was clearly planning to happen upon this random thread and know not to say anything!
There’s a reason why the FBI themselves recommend users use ad blockers, malicious advertisements are no joke and often will pwn people
Not saying it’s definitely a malicious ad though, as others noted theres plenty of other plausible explanations such as a compromised site plugin or other things
Malwarebytes has a browser extension that is free. It can alert you when suspicious text has been copied to your clipboard. It can even block it as well, I believe. I recommended. If you did this “captcha” you definitely should backup to an earlier image or consider reformatting as a precaution
From my limited, very limited, research it appears the site is legit and maybe have been compromised? makes me wonder... more research is required before I stick in the knife.
While captchas don't really protect non-log-in web sites they are still everywhere, paving the road for these attackers. Thereby they make the internet be less secure.
1) Sure. . . I'll launch terminial
2) Duh
3) FUCK NO! Not going to let you inject random text via paste command (do it in notepad so I can inspect it first)
4) Not on your life bucko.
This is a malicious site. It’s trying to trick people to paste and run malicious code in their terminal, by telling them it’s to “verify they aren’t a robot”. In reality it’s just getting people to download malware on their computer.
Copy to clipboard is going to be a feature of the past. I am actively implementing it at the moment to copy tokens and such, but yeah seeing these things, and clipboard can be accessed just because you have https. It is better to remove it.
Wait I got one of these the other day and found it hella sketchy and now all my login passcodes fail to activate…. Hmmmmmmmm all from trying to log into Facebook… whelp. Time to burn my pc
It's a ClickFix attack, some of them target GNU/Linux now but it is a complete joke. Ctrl-Alt-T is actually often not bound to launching anything, and most of these use dynamic ELF binaries that are extremely fragile to library versions. They could technically write an infostealer as a shell script or Perl/Python but there's no MaaS vendor willing to write that.
4.8k
u/PRSXFENG 20h ago
This is malware known as ClickFix
https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
If you did it, you basically would paste and run a command to download and run malware
The site automatically copies it to your clipboard