Fake CAPTCHA Scam Targets Millions of University Students With Unknown Malware: Report

A fake CAPTCHA prompt is reportedly responsible for tricking millions of college students and instructors into installing malware on their devices.

The ClickFix scam targeted the popular student engagement platform website iClicker, which allows instructors to take attendance, ask live questions or surveys and track student engagement, reports the tech news site Bleeping Computer.

A ClickFix is a social engineering scam that appears as an authentic message to manipulate users into executing malicious scripts.

The platform iClicker is used by 5,000 instructors and 7 million students at multiple colleges, including the University of Michigan, the University of Florida and several of California’s universities.

According to the University of Michigan’s Safe Computing team, the iClicker scam displayed a fake CAPTCHA that instructed users to press “I’m not a robot” to verify themselves. If the fake CAPTCHA was pressed and the subsequent instructions were followed, the device became infected with the malware.

In response to the incident, iClicker says,

“We recently resolved an incident affecting the iClicker landing page (iClicker.com). Importantly, no iClicker data, apps, or operations were impacted and the identified vulnerability on the iClicker landing page has been resolved.

What happened: an unrelated third party placed a false CAPTCHA on our iClicker landing page before users logged into iClicker on our website. This third party was hoping to get users to click on the false CAPTCHA similar to what we unfortunately experience quite often in phishing emails these days.

Out of an abundance of caution, we recommend that any faculty or student who encountered and clicked on the false CAPTCHA from April 12th to April 16th on our website run security software to ensure their devices remain protected.”

Generated Image: Midjourney