DoubleClickjacking: A New type of web hacking technique

There is also a technique where they ask you to press: [Win + R] + [CRTL + V] + [ENTER] to verify that you are human.

This will install malware code that was put in the clipboard by using javascript.

The "Run" app appears right after pressing Win+R, so this wouldn't work.

I tried it on a VM, it did work. [WIN + R] opens the run app down left in the left corner.

[CRTL + V] pastes a small code snippet in the run app and once [ENTER] is pressed it closes the run app and in the background downloads and executes a larger code snippet from a malicious website.

So if you press exactly what they told you to press it would install a malware on your computer. Now this typically targets people that don't even know what the run app is.

There is the classic "drive by download attack" where you have nothing to press.

yeah, you paste malicious code into the run window (basically a powershell) and then paste in code. pretty obvious most of the time

Letting javascript manipulate the clipboard was a mistake. Yet another "feature" that's added for apps but absolutely useless for the web.

I really hate that browsers have started to just download shit without asking you where to save it. "Convenience" my ass.