Someone I know said that while attempting to use archive.ph they were presented with what appeared to be a #Cloudflare captcha that asked them to copy text from one box on the webpage and paste it into another. They felt this seemed too much like some sort of phishing and did not do it, but now the question is this: is this actually some sort of captcha that is used by Cloudflare or a similar service?
In searching form information on this, all I keep coming upon are articles about the ClickFix attack, but as far as I can tell that's usually about tricking the user into pasting some text into a system shell, whereas this just seemed to want the text pasted into another window in the page. So I'm trying to figure out if this was some clever, more innocuous-looking variant of the attack or a legitimate (but weird) captcha mechanism of some sort.
#infosec #security #phishing
Nick
npub125…ceqaf
2025-10-31 01:27:39 UTC
Author Public Key
npub1254wcjqdese7zgtsnxcf3j2g2a2erlk5rm6l5rtl00spfhj9qcmsqceqafSeen on
wss://relay.ditto.pubPublished at
2025-10-31 01:27:39 UTCEvent JSON
{
"id": "d3675de355139280cf537facafe4227e190de177d37eb02d9b3a8448963310d8",
"pubkey": "552aec480dcc33e1217099b098c948575591fed41ef5fa0d7f7be014de450637",
"created_at": 1761874059,
"kind": 1,
"tags": [
[
"t",
"phishing"
],
[
"t",
"security"
],
[
"t",
"infosec"
],
[
"t",
"cloudflare"
],
[
"proxy",
"https://mathstodon.xyz/users/internic/statuses/115466178392658144",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub/"
]
],
"content": "Someone I know said that while attempting to use archive.ph they were presented with what appeared to be a #Cloudflare captcha that asked them to copy text from one box on the webpage and paste it into another. They felt this seemed too much like some sort of phishing and did not do it, but now the question is this: is this actually some sort of captcha that is used by Cloudflare or a similar service?\n\nIn searching form information on this, all I keep coming upon are articles about the ClickFix attack, but as far as I can tell that's usually about tricking the user into pasting some text into a system shell, whereas this just seemed to want the text pasted into another window in the page. So I'm trying to figure out if this was some clever, more innocuous-looking variant of the attack or a legitimate (but weird) captcha mechanism of some sort.\n\n#infosec #security #phishing",
"sig": "e4aa8c49dc99a8653ad7ed7573cfe7ff994942f4cbd48afba35b3792ecb4d323c6aedfccbcd2fdb02921141741f5c26701d373b7b23cef3b978075ad1223073b"
}