{"id":160704,"date":"2026-01-13T15:06:50","date_gmt":"2026-01-13T20:06:50","guid":{"rendered":"https:\/\/www.bu.edu\/tech\/?page_id=160704"},"modified":"2026-01-14T10:07:05","modified_gmt":"2026-01-14T15:07:05","slug":"beyond-email-3-unconventional-phishing","status":"publish","type":"page","link":"https:\/\/www.bu.edu\/tech\/support\/information-security\/security-for-everyone\/beyond-email-3-unconventional-phishing\/","title":{"rendered":"Beyond email: 3 Unconventional Phishing Tactics"},"content":{"rendered":"
\n
ClickFix scams<\/strong>\u00a0<\/span>are a type of social engineering attack that tricks users into unknowingly running malicious commands on their own computers by presenting fake system or browser errors. The victim is manipulated into performing a sequence of actions that bypass standard security measures and install malware.<\/div>\n
<\/div>\n
How a ClickFix Scam Works<\/strong><\/div>\n
<\/span><\/span>The attack typically follows a clever multi-step process that exploits user trust and the desire to “fix” an apparent problem quickly.<\/div>\n
    \n
  • The Lure:<\/strong>\u00a0<\/span>The victim encounters a pop-up message on a malicious or compromised website that mimics a legitimate alert, such as a “Verify you’re human” CAPTCHA, a browser update notification, or an error message (e.g., “Aw, Snap!” or “Word Online extension missing”).<\/span><\/li>\n
  • The Deception:<\/strong>\u00a0<\/span>The prompt provides instructions on how to solve the problem, often involving a “Fix It” or “Copy Fix” button. Clicking this button uses a malicious script to silently copy an obfuscated, harmful command to the user’s clipboard.<\/span><\/li>\n
  • The Execution:<\/strong>\u00a0<\/span>The user is then instructed to open a legitimate system utility, typically the Windows\u00a0<\/span>Run<\/strong>\u00a0<\/span>dialog box (by pressing\u00a0<\/span>Windows + R<\/code>), paste the clipboard’s content (using\u00a0<\/span>Ctrl + V<\/code>), and press\u00a0<\/span>Enter<\/code>.<\/span><\/li>\n
  • The Payload:<\/strong>\u00a0<\/span>By executing the command, the user inadvertently launches a script that downloads and installs malware, such as information stealers (e.g., Lumma Stealer), remote access trojans (RATs), or other harmful payloads.<\/span><\/li>\n<\/ul>\n
    Because the user initiates the command themselves using a legitimate system tool, the action often bypasses traditional antivirus and browser security warnings.<\/div>\n
    <\/div>\n
    How to Protect Yourself<\/strong><\/div>\n
    <\/span><\/span>User awareness is the most effective defense against ClickFix scams.<\/div>\n
      \n
    • Never copy and paste commands from unfamiliar or suspicious sources.<\/strong>\u00a0<\/span>No legitimate website or service will ask you to open a system terminal (like Run, PowerShell, or Mac Terminal) and paste code to verify your identity or fix an issue.<\/span><\/li>\n
    • Close suspicious pop-up windows immediately.<\/strong>\u00a0<\/span>If a website displays an unexpected error message or security prompt, do not interact with it. Use the Task Manager (Ctrl + Shift + Esc) to close the browser if necessary.<\/span><\/li>\n
    • Keep your systems and applications updated.<\/strong>\u00a0<\/span>Use reputable antivirus\/endpoint protection software that employs behavioral analysis to detect unusual activity, such as suspicious command execution, even if a known malware signature isn’t present.<\/span><\/li>\n
    • Be cautious with all online interactions.<\/strong>\u00a0<\/span>Be wary of urgent language, unexpected security checks, or requests for unusual actions, regardless of how legitimate the page looks.<\/span><\/li>\n
    • Verify the source of information.<\/strong>\u00a0<\/span>If you receive an unexpected notification (e.g., from a bank, social media, or IT support), do not use the links or instructions provided. Instead, navigate directly to the official website or contact the organization through a trusted, known method.<\/span>\u00a0<\/span><\/span><\/li>\n<\/ul>\n<\/div>\n
      Collaboration tool impersonation scammers<\/strong>\u00a0<\/span>are cybercriminals who exploit business communication platforms (such as Microsoft Teams, Slack, or Zoom) to pose as trusted colleagues, executives, or vendors. Their goal is to deceive employees into performing actions that result in financial loss or the exposure of sensitive information.<\/div>\n
      <\/div>\n
      How the Scams Work<\/strong><\/div>\n
      Scammers leverage the trust and fast-paced nature of collaborative work environments to bypass normal security protocols. The attack typically involves several phases:<\/div>\n
        \n
      1. Research<\/strong>: Attackers gather information on potential targets (e.g., finance officers, HR staff) and senior executives using public sources like LinkedIn and company websites.<\/span><\/li>\n
      2. Impersonation<\/strong>: They create fake accounts, spoof email domains, or compromise existing accounts to make their communications appear legitimate. Advanced scammers use AI to clone voices or create deepfake videos of executives to enhance credibility.<\/span><\/li>\n
      3. The Ask<\/strong>: The scammer contacts the target via a chat message or email, often creating a sense of\u00a0<\/span>urgency<\/strong>\u00a0<\/span>(“I’m in a meeting and need this done now”) or authority. Common requests include:<\/span>\n
          \n
        • Initiating a wire transfer to a fraudulent account (known as Business Email Compromise or CEO Fraud).<\/span><\/li>\n
        • Sharing sensitive data like W-2 forms or login credentials.<\/span><\/li>\n
        • Clicking on a malicious link that installs malware or leads to a phishing site.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n
          Red Flags and Protection<\/strong><\/div>\n
          Identifying these scams can be difficult, as they often lack traditional red flags like spelling errors and are designed to blend into everyday communications.<\/div>\n
            \n
          • Verify Requests<\/strong>: Always verify urgent or unusual requests through a secondary, trusted communication channel (e.g., call the person’s known phone number or use a different platform).<\/span><\/li>\n
          • Be Skeptical of Urgency<\/strong>: Scammers use pressure to prevent critical thinking. Legitimate organizations and executives rarely demand immediate action without proper channels.<\/span><\/li>\n
          • Check the Sender’s Details<\/strong>: Look closely at the email address or username for subtle variations, typosquatting, or look-alike domains (e.g.,\u00a0<\/span>company.io<\/code>\u00a0<\/span>instead of\u00a0<\/span>company.com<\/code>).<\/span><\/li>\n
          • Report Suspicious Activity<\/strong>: Promptly report any suspicious communication to abuse@bu.edu.<\/span><\/li>\n<\/ul>\n
            Quishing (QR code phishing)<\/strong> is a cyberattack using malicious QR codes, often in emails, texts, or physical locations, to trick victims into scanning them, leading to fake login pages to steal credentials, fraudulent apps for malware, or sensitive data theft for identity fraud, bypassing standard email filters by relying on mobile scanning. Attackers embed malicious links in QR codes that look legitimate (like for discounts or HR notices) but redirect users to spoofed sites to harvest personal info, passwords, or install malware.<\/div>\n
            <\/div>\n
            How it works<\/strong><\/div>\n
              \n
            • <\/span><\/span>Delivery<\/strong>: <\/span>Scammers place QR codes in emails (as images), texts, or even on physical posters\/menus, impersonating trusted entities like banks, government, or delivery services.<\/li>\n<\/ul>\n
                \n
              • The Lure<\/strong>: The code promises a reward (discount, urgent notice) or appears in a trusted context (like an office breakroom).<\/span><\/li>\n
              • The Scan<\/strong>: You scan the code with your phone, which hides the malicious URL from email security.<\/span><\/li>\n
              • The Trap<\/strong>: You land on a fake website or download malware, giving up credentials, financial details, or infecting your device.<\/span><\/li>\n<\/ul>\n
                <\/div>\n
                Why it’s effective<\/strong><\/div>\n
                  \n
                • <\/span><\/span>Bypasses filters<\/strong>: Email security can’t inspect the URL inside a QR image.<\/span><\/li>\n<\/ul>\n
                    \n
                  • Mobile convenience<\/strong>: Users are accustomed to scanning codes on mobile, often without scrutinizing the URL.<\/span><\/li>\n
                  • Physical context<\/strong>: Codes on posters or menus feel more tangible and trusted.<\/span><\/li>\n<\/ul>\n
                    <\/div>\n
                    How to protect yourself<\/strong><\/div>\n
                      \n
                    • <\/span><\/span>Pause before scanning<\/strong>: Don’t scan unexpected QR codes in emails or physical spots.<\/span><\/li>\n<\/ul>\n
                        \n
                      • Inspect the source<\/strong>: Check the sender and message for red flags like poor grammar.<\/span><\/li>\n
                      • Verify independently<\/strong>: Be extra skeptical if an email from HR has a QR code, go to the BU.EDU\/HR directly, don’t use the code.<\/span><\/li>\n
                      • Use MFA<\/strong>: At BU we use DUO Multi-factor authentication which adds a layer of defense even if credentials are stolen. Make sure to use it whenever you can for your personal accounts!\u00a0<\/span><\/li>\n
                      • Be wary of discounts<\/strong>: Be suspicious of offers in unexpected QR codes.<\/span><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

                        ClickFix scams\u00a0are a type of social engineering attack that tricks users into unknowingly running malicious commands on their own computers by presenting fake system or browser errors. The victim is manipulated into performing a sequence of actions that bypass standard security measures and install malware. How a ClickFix Scam Works The attack typically follows a…<\/p>\n","protected":false},"author":4352,"featured_media":0,"parent":101545,"menu_order":1,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"_links":{"self":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/160704"}],"collection":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/users\/4352"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/comments?post=160704"}],"version-history":[{"count":5,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/160704\/revisions"}],"predecessor-version":[{"id":160721,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/160704\/revisions\/160721"}],"up":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/101545"}],"wp:attachment":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/media?parent=160704"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}