Fake CloudFlare verification screen - Beaware of the malware

[Shishir99]

I am creating this thread to spread awarness.

I have been seeing some reports on the internet that people are downloading malware on their computer without understanding and their computers are getting compromised. A several websites now using this trick to fool the users and the victims are downloading the malware thinking they are doing cloudflare verification to access the website or download some files.

Here are some of the screenshots that I saw online and there are more like this.

 

Cloudflare never ask you to press any button on the keyboard. Cloudflare verification mostly automatic. Bot fighting mode sometimes needs you to do captcha verification.

[rohang]

Thanks for awareness on this.

Really well made and innovative by those people i must say, will scam many people with this sadly.

[PostQuantumBTC]

This does not look like cloudflare at all

Another thing is that if you want to visit a site and you see the cloudflare, you will not see the name their site until you click on the link written in their name which is beside a link to privacy.

Also the cloudflare website is https://www.cloudflare.com/ but the one in that OP image is different which indicates it is not the original cloudflare.

[noorman0]

I wonder if these sites implemented this fake Cloudflare themselves, or if their sites is being compromised by attackers?

-snip-
but the one in that OP image is different which indicates it is not the original cloudflare.

Most uncritical users are impulsive and simply assume it's display update and verification method enhancement.

They don't even know why Cloudflare was implemented everywhere.

[Yamane_Keto]

This is a lower level of Clipboard hijacking, and for this scam to succeed, the domain must be granted Clipboard access permissions. Random domains should not be allowed to receive these permissions.

[TryNinja]

This is a lower level of Clipboard hijacking, and for this scam to succeed, the domain must be granted Clipboard access permissions. Random domains should not be allowed to receive these permissions.

I don't think this is exactly true.

You can arbitrarily run navigator.clipboard.writeText(...) and all the user needs to do on most browsers is be on HTTPS (easy, Let's Encrypt) and any interaction to the website (like clicking on the "Verify" button). Nowhere you need to give any explicit permission. Also, if you're falling for a phishing scam you would do that to "verify" your access.

[Shishir99]

This does not look like cloudflare at all

Another thing is that if you want to visit a site and you see the cloudflare, you will not see the name their site until you click on the link written in their name which is beside a link to privacy.

Also the cloudflare website is https://www.cloudflare.com/ but the one in that OP image is different which indicates it is not the original cloudflare.

What makes you think I do not understand any of these things?

We are talking about the internet newbies who might fall for these scams. Since these scam methods are working, more and more scammers are using the same tricks, and people are falling for them. You don't need to visit cloudflare.com to face the Cloudflare verification. A lot of websites use the Cloudflare service to protect their website from DDoS attacks and from bots. If you are using a public IP address that is blacklisted, you will need to complete the verification to access that website.

[Zwei]

i never came across this before, kinda smart not gonna lie.

I wonder if these sites implemented this fake Cloudflare themselves, or if their sites is being compromised by attackers?

i don't think someone running a website would be dumb enough to implement a fake cloudflare protection, so it's most likely either one of those annoying popup ads some sites use to monetize their traffic, or sites getting compromised.
if you use a good adblock you would not need to worry about having to deal with phishing attacks using ads 99% of the time.

also google recently introduced QR code captchas that you need to scan with your phone to prove you are not AI: https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-fraud-defense-the-next-evolution-of-recaptcha#:~:text=New%20QR%2Dcode%20challenge%20in%20a%20shopping%20website.
i imagine the same trick could be used for that in a similar form, so people should be wary of that as well.

[Shishir99]

Thanks for awareness on this.

Really well made and innovative by those people i must say, will scam many people with this sadly.

You're welcome.
Since some people have already fallen for it and become victims, I feel like it will work on others as well. All we can do is try to spread the awarness so more people see the new tricks, and they become cautious. When I saw that report online myself, I was also surprised to see that scammers are evolving and introducing new tricks to scam people. You will also find some Reddit threads about this scam.

[DYING_S0UL]

I feel like I have seen something similar before (maybe this exact one), where it askes you to verify and in order to do so, you have to press bunch of keyboard shortcuts, and one of them leads of the "run" option.
A lot of keyboard pressing just to pass a simple human check? Nah, I'll pass. I'm pretty surprised to see people still falling for such stupid tricks. I mean there are so many red flags painted all over them. If one paid the minimum/least amount of attention, he'll notice these irregularities ...but yet...Its unfortunate some people still falls for this.