5,400 hacked websites are tricking visitors into installing malware

More than 5,400 hacked websites are being used in a large-scale campaign designed to trick visitors into installing malware on their own computers.

The attacks use a technique known as 'ClickFix', which relies on convincing people to follow seemingly legitimate instructions that actually execute malicious commands.

What makes the campaign particularly deceptive is that victims may initially be visiting a genuine website.

Cybercriminals compromise legitimate sites and inject malicious code that redirects selected visitors towards fake error messages or verification screens.

The dangerous instruction to watch for

Instead of exploiting a software vulnerability directly, ClickFix attacks try to persuade the user to perform the critical step.

A visitor may see what appears to be a browser error, CAPTCHA check, or security message telling them to copy and paste a command, open a Windows tool or follow several keyboard instructions.

Following those directions can execute malicious code on the computer.

Researchers have identified more than 5,400 compromised websites used in the campaign.

Many belong to legitimate small businesses and organisations whose sites have themselves been hacked.

That means simply recognising the website or business may not be enough to establish that an unexpected security prompt is safe.

Malware stored using blockchain technology

Researchers investigating the campaign also found attackers using blockchain-based infrastructure to help deliver malicious payloads.

This can make parts of the attack harder to disrupt because the criminals are not relying entirely on conventional web-hosting infrastructure that can simply be taken offline.

The ultimate objective is to infect victims’ devices with malware.

What users should never do

A legitimate website should not unexpectedly ask visitors to open Windows PowerShell, Command Prompt or another system utility and paste a command to verify they are human or fix a browser problem.

Users should be particularly suspicious if a webpage asks them to:

• Press combinations of keyboard shortcuts.

• Open Windows Run, PowerShell or Command Prompt.

• Paste commands copied from a website.

• Disable security software.

• Download an unexpected file to complete a CAPTCHA or verification check.

If such instructions suddenly appear, users should close the webpage instead of following them.

Keeping browsers, operating systems and security software updated can provide additional protection, but ClickFix attacks primarily exploit human trust rather than an unpatched vulnerability.

The campaign is another example of cybercriminals shifting towards social-engineering techniques that persuade victims to compromise their own devices unknowingly.