How to Browse Safely Amid Fake Verification Attacks and Web Security Flaws
Summary
Criminals have used hacked legitimate websites to show fake verification prompts that trick visitors into running malware. The article offers practical steps for safer browsing amid other recent web security problems.
Key points
- Researchers documented attacks using hacked legitimate WordPress sites to deliver fake verification pages that trick visitors into installing malware.
- ClickFix attacks disguise malicious commands as routine verification or troubleshooting; unexpected requests to run code should be independently checked.
- A secure HTTPS connection does not guarantee that a page or its instructions are safe.
- The article notes exploitation of two PHP flaws, a critical Brotli flaw in software used by Node.js, and concerns over eight compromised security certificates.
- Keep operating systems, browsers, and applications updated, and leave browser phishing and malware protections enabled.
- Use unique passwords and multifactor authentication, and verify account or update prompts through official channels.
Article Details
- Topic
- Safe browsing guidance amid compromised websites, ClickFix attacks, and web security incidents
Vendors
Products
Malwarebytes Browser GuardFree browser extensions like Malwarebytes Browser Guard warn about known dangerous websites, malicious downloads, and clipboard hijacking.Malwarebytes Scam GuardIf you’re unsure, use Malwarebytes Scam Guard to check whether a request may be a scam and get possible next steps.Node.jswere exploiting two flaws in PHP, researchers disclosed a critical flaw in Brotli software used by Node.js, and eight compromised security certificates raised concerns about how browsers and apps verify websites.WordPressIn documented campaigns, malicious instructions appeared on legitimate, hacked WordPress websites, not just lookalike domains.