McAfee Discovers New Phishing Campaign Targeting GitHub Users
A phishing campaign is targeting GitHub users with phony CAPTCHA pages, according to researchers at McAfee. The phishing emails ask users to address a security vulnerability in a GitHub repository that they recently contributed to, and contain a link to find more information about the alleged vulnerability. This link leads to a fake CAPTCHA page that attempts to trick them into installing malware.
“The ClickFix infection chain operates by deceiving users into clicking on buttons like ‘Verify you are a human’ or ‘I am not a robot,’” the researchers write. “Once clicked, a malicious script is copied to the user’s clipboard. Users are then misled into pasting the script after pressing the Windows key + R, unknowingly executing the malware. This method of trickery facilitates the infection process, making it easy for attackers to deploy malware.”
Users should be extremely suspicious of any site that asks them to press the Windows key + R, as this will open a “Run” prompt on their computer. You should never enter code into a Run prompt without understanding exactly what it does, and a legitimate CAPTCHA test will never require this level of access.
McAfee offers the following recommendations to help users avoid falling for these attacks:
- Conduct regular training sessions to educate users about social engineering tactics and phishing schemes.
- Install and maintain updated antivirus and anti-malware software on all endpoints.
- Implement robust email filtering to block phishing emails and malicious attachments.
- Use network segmentation to limit the spread of malware within the organization.
- Ensure all operating systems, software, and applications are kept up to date with the latest security patches.
- Verify URLs in emails, especially from unknown or unexpected sources.
- Restrict clipboard-based scripts and disable automatic script execution.
- Keep antivirus solutions updated and actively scan.
- Educate users to avoid suspicious CAPTCHA prompts on untrusted sites.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
McAfee has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW