Malware problem (fixed)

by John Q on July 29, 2026

A number of commenters noted a malware problem with the site.It appears to be a well known attack called ClickFix.

It’s now fixed, thanks again to Doctor Memory

{ 12 comments }

1

Doctor Memory 07.30.26 at 2:36 pm

Never a dull moment. The good news (such as it is) is that as far as we can tell this was a drive-by insertion of a crypto wallet draining malware and I’m guessing that CT’s readership is maybe a little less likely than the average internet user to even have a crypto wallet to drain?

2

Ingrid 07.30.26 at 8:08 pm

Thanks Doctor Memory! Much appreciated.

3

engels 07.30.26 at 10:09 pm

Damn. I knew being a bitcoin billionaire wouldn’t last.

4

Starfleet Dude 07.31.26 at 12:17 am

I did experience the malware interregnum, but was aware enough to not do the copy-pasta instructions. Not that I have a crypto wallet anyway!

5

Alan White 07.31.26 at 4:36 am

When I saw the prove you’re not a robot thingy my BS meter really went off. Thanks Dr. Memory!

6

BBA 07.31.26 at 10:31 pm

I just saw the fake captcha again. Double check your server.

7

SamChevre 08.02.26 at 12:19 am

Today (8/1) I got the same malware pop-up when entering the site, but the site then loaded without any action on my part.

8

Chris Bertram 08.02.26 at 8:54 am

I’m not getting the captcha, so I wonder whether there’s a caching issue for some people. There will be more work done on the site today.

9

Doctor Memory 08.03.26 at 4:14 pm

SamChevre and anyone else who sees/saw the phony CAPTCHA after 8/1: it would be very helpful to know if it persists if you kill the tab and re-load the site. If you see it once and never again, that’s annoying but not unexpected. (It means you had a copy of the infected javascript cached and it rendered the captcha one last time before our fix loads in your browser.) If you see it consistently that’s a bird of a different feather and means that I (and dreamhost) are missing something important.

10

SamChevre 08.04.26 at 2:48 pm

Since seeing the pop-up that one time, and it disappearing momentarily, I have not seen it again.

11

Aardvark Cheeselog 08.04.26 at 4:52 pm

My only regret is that I failed to immediately open an instance of Notepad and paste into it whatever got stuffed into my clipboard by the first click on the “prove you’re not a robot” box.

Because when I saw “Please paste what we just put into your clipboard into a run prompt and execute it,” I noped out too fast and hard to think about that.

12

Ingrid 08.04.26 at 8:00 pm

I also had the pop-up before, and now I no longer do. Thanks again Doctor Memory!

Comments on this entry are closed.