News

Have you heard of TerminalFix attacks? Not every CAPTCHA is what it seems!

You’re no doubt familiar with Cloudflare’s well-known ‘I am not a robot’ prompts, where you simply have to tick a box whilst the system analyses the slightest mouse movements in the background. Unfortunately, attackers are now also exploiting this familiar interface to instil a sense of trust. In this way, they attempt to trick users into executing malicious commands designed to grant them access to the user’s device.

When visiting a malicious website, a Captcha dialogue box that appears familiar is displayed. If you click on the box, a further dialogue box appears, prompting users to carry out certain actions. Unnoticed by the user, a Windows command line is copied to the clipboard with that very first click. If you then follow the steps shown in the dialogue box, this command is executed in PowerShell. This downloads a payload from the internet, which then installs malware and thereby establishes external access to the device.

Please contact HCU IT if you have fallen victim to such an attack on your work device! 

Further information can be found at TerminalFix campaign deploys a reverse tunnel through multistage intrusion | Microsoft Security Blog [EXTERNAL]. 

Soon the new episode of SoSafe begins!

An important part of information security is not regarding software itself but regarding humans. Many cyberattacks do not start with highly complex technology, but rather with a simple phishing email. That’s why it is important for all of us at HCU to refresh our basic knowledge of cybersecurity from time to time. We do that by utilizing SoSafe. SoSafe is an e-learning tool with several short videos and quizzes. All modules are available both in English and German.

You can always learn more about SoSafe including how to take part at: en/hcu-informationssicherheit/sosafe

Currently there is an increase in CEO fraud email being sent in the name of the President. Please just delete them!