There was some discourse yesterday around the prevalence of users reporting on reddit that they’d fallen for the ClickFix malware campaign. For those that don’t know, this is a malware variant that impersonates a captcha (specifically CloudFlare) and attempts to get the user to perform malicious actions.
In this case, the malware tells the user to hit win+R, paste a malicious command that was placed in the user’s clipboard via javascript, and press enter to run it. This then will download the malicious package and run it, completing an infostealer attack, harvesting credentials and other personal information like payment information.
Which then reminds me of the old meme of the Albanian Computer Virus that tells the user to please delete important files off their machine because the virus does not have the technology to implement it itself:
While this seems like something that can only be remedied by end user training, there is something that enterprises can do to protect their end users.
For organizations running Active Directory, there is a fix that can be implemented with a simple GPO change. In Active Directory, under Computer Configuration > Administrative Templates > Start Menu and Taskbar, an administrator will find “Remove Run menu from Star Menu”:
By editing this policy and setting it to enabled, this will disable:
- The Run command from the Start Menu
- New Task from the task manager (ctrl+alt+del)
As well as removing from Internet Explorer, the ability to:
- access a UNC path (ie a fileshare)
- accessing a local drive
- accessing any local folders
Wholly preventing a user from being able to attempt such an action.
If you’re on EntraID without a hybrid setup this becomes markedly less trivial, and will need to be done with a Powershell script:
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /V NoRun /t REG_DWORD /d 1
Deploy the script, or if you are on-prem/hybrid, Group Policy by default runs every 90 minutes, and now your users are covered and won’t run any Albanian Computer Viruses.