{"id":170353,"date":"2026-09-04T11:45:14","date_gmt":"2026-09-04T11:45:14","guid":{"rendered":"https:\/\/www.europesays.com\/sk\/170353\/"},"modified":"2026-09-04T11:45:14","modified_gmt":"2026-09-04T11:45:14","slug":"pozor-na-tento-novy-podvod-nie-som-robot-na-ktory-mozes-natrafit-na-internete-hackerom-nim-otvoris-dvere-do-pocitaca-vosveteit-sk","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/sk\/170353\/","title":{"rendered":"Pozor na tento nov\u00fd podvod \u201eNie som robot\u201c, na ktor\u00fd m\u00f4\u017ee\u0161 natrafi\u0165 na internete. Hackerom n\u00edm otvor\u00ed\u0161 dvere do po\u010d\u00edta\u010da | Vosveteit.sk"},"content":{"rendered":"

Falo\u0161n\u00e1 CAPTCHA od Cloudflare m\u00f4\u017ee vyzera\u0165 ako oby\u010dajn\u00e9 overenie, \u017ee nie si robot. Bezpe\u010dnostn\u00ed v\u00fdskumn\u00edci v\u0161ak upozor\u0148uj\u00fa na nov\u00fd \u00fatok, pri ktorom pr\u00e1ve tak\u00e1to str\u00e1nka presved\u010d\u00ed pou\u017e\u00edvate\u013ea, aby do Windows Terminalu vlo\u017eil \u0161kodliv\u00fd pr\u00edkaz.<\/p>\n

Microsoft<\/a> tento \u00fatok ozna\u010duje ako TerminalFix a pod\u013ea jeho bezpe\u010dnostn\u00fdch v\u00fdskumn\u00edkov ide o variant zn\u00e1mej techniky ClickFix<\/a>. \u00dato\u010dn\u00edci pri nej zneu\u017e\u00edvaj\u00fa d\u00f4veru pou\u017e\u00edvate\u013eov v be\u017en\u00e9 bezpe\u010dnostn\u00e9 overenia. Tentoraz v\u0161ak namiesto klasick\u00e9ho okna Spusti\u0165 pou\u017e\u00edvate\u013ea nasmeruj\u00fa priamo do Windows Terminalu alebo PowerShellu. A to \u00fato\u010dn\u00edkom umo\u017en\u00ed spusti\u0165 podstatne zlo\u017eitej\u0161\u00ed re\u0165azec pr\u00edkazov.<\/p>\n

<\/p>\n

<\/p>\n

Odoberaj Vosveteit.sk cez Telegram a prihl\u00e1s sa k odberu spr\u00e1v
\n <\/a><\/p>\n

V\u0161etko sa za\u010d\u00edna falo\u0161nou CAPTCHA<\/p>\n

\u00datok sa za\u010dne na napadnutej webovej str\u00e1nke. Namiesto p\u00f4vodn\u00e9ho obsahu sa pou\u017e\u00edvate\u013eovi zobraz\u00ed okno, ktor\u00e9 sa podob\u00e1 na Cloudflare Turnstile. Nech\u00fdba logo Cloudflare, v\u00fdzva na potvrdenie, \u017ee \u010dlovek nie je robot, ani anim\u00e1cia napodob\u0148uj\u00faca skuto\u010dn\u00e9 overenie. Pou\u017e\u00edvate\u013e tak m\u00f4\u017ee nadobudn\u00fa\u0165 dojem, \u017ee ide o be\u017en\u00fa ochranu str\u00e1nky.<\/p>\n

\"Microsoft\"MicrosoftZdroj: Microsoft<\/a><\/p>\n

Po kliknut\u00ed v\u0161ak str\u00e1nka skop\u00edruje \u0161kodliv\u00fd PowerShell pr\u00edkaz do schr\u00e1nky. N\u00e1sledne n\u00e1v\u0161tevn\u00edka vyzve, aby otvoril Windows Terminal alebo PowerShell a pr\u00edkaz tam vlo\u017eil. Pr\u00e1ve tento krok predstavuje hlavn\u00fd trik cel\u00e9ho \u00fatoku. Pou\u017e\u00edvate\u013e toti\u017e \u0161kodliv\u00fd pr\u00edkaz nespust\u00ed automaticky. Spustenie s\u00e1m potvrd\u00ed, preto\u017ee ver\u00ed, \u017ee iba dokon\u010duje bezpe\u010dnostn\u00e9<\/a> overenie. Termin\u00e1l navy\u0161e zobraz\u00ed falo\u0161n\u00e9 spr\u00e1vy, ktor\u00e9 napodob\u0148uj\u00fa proces overovania Cloudflare. \u00dato\u010dn\u00edci tak vytv\u00e1raj\u00fa dojem, \u017ee sa v po\u010d\u00edta\u010di deje nie\u010do \u00faplne legit\u00edmne.<\/p>\n

Microsoft upozor\u0148uje, \u017ee ide o v\u00fdrazn\u00fa zmenu oproti star\u0161\u00edm \u00fatokom ClickFix.<\/p>\n

Neprehliadni
\n <\/p>\n

\"V\"V <\/p>\n

\n\t\t\t\t\tVIDEO: Tak\u00fdto z\u00e1pas neuvid\u00ed\u0161 ani v Mortal Kombat. Robot odkopol s\u00faperovi hlavu, ten bojoval \u010falej <\/p>\n

<\/a><\/p>\n

\"Microsoft\"MicrosoftZdroj: Microsoft<\/a><\/p>\n

Do po\u010d\u00edta\u010da sa dostane legit\u00edmny program aj \u0161kodliv\u00e1 kni\u017enica<\/p>\n

Po spusten\u00ed pr\u00edkazu PowerShell stiahne ZIP arch\u00edv a rozbal\u00ed ho do prie\u010dinka v C:\\ProgramData. N\u00e1sledne spust\u00ed d\u00e1vkov\u00fd s\u00fabor, ktor\u00fd priprav\u00ed \u010fal\u0161iu f\u00e1zu \u00fatoku.<\/p>\n

\"Microsoft\"MicrosoftZdroj: Microsoft<\/a><\/p>\n

V arch\u00edve sa nach\u00e1dza legit\u00edmny podp\u00edsan\u00fd s\u00fabor LockScreenContentServer.exe a \u0161kodliv\u00e1 kni\u017enica dui70.dll. Samotn\u00fd EXE s\u00fabor preto nemus\u00ed na prv\u00fd poh\u013ead vyzera\u0165 podozrivo. \u00dato\u010dn\u00edci v\u0161ak zneu\u017eili sp\u00f4sob, ak\u00fdm Windows h\u013ead\u00e1 potrebn\u00e9 DLL kni\u017enice. Ak sa \u0161kodliv\u00e1 kni\u017enica nach\u00e1dza na mieste, odkia\u013e ju program o\u010dak\u00e1va, syst\u00e9m ju m\u00f4\u017ee na\u010d\u00edta\u0165 namiesto skuto\u010dnej kni\u017enice. Bezpe\u010dnostn\u00ed experti t\u00fato techniku ozna\u010duj\u00fa ako DLL sideloading.<\/p>\n

\u00dato\u010dn\u00edk tak dok\u00e1\u017ee spusti\u0165 \u0161kodliv\u00fd k\u00f3d prostredn\u00edctvom programu, ktor\u00fd m\u00e1 platn\u00fd digit\u00e1lny podpis a vyzer\u00e1 d\u00f4veryhodne.<\/p>\n

\u0160kodliv\u00e1 dui70.dll navy\u0161e ukr\u00fdva \u010fal\u0161\u00ed k\u00f3d vo svojej vlastnej d\u00e1tovej \u010dasti. Po na\u010d\u00edtan\u00ed ho rozbal\u00ed priamo v pam\u00e4ti a pokra\u010duje v \u00fatoku.<\/p>\n

\u010eal\u0161ie s\u00fabory ukryj\u00fa dokonca do obr\u00e1zkov<\/p>\n

V \u010fal\u0161ej f\u00e1ze prich\u00e1dza e\u0161te menej n\u00e1padn\u00e1 technika. Malv\u00e9r<\/a> stiahne z \u00fato\u010dn\u00edkov\u00fdch serverov nieko\u013eko PNG obr\u00e1zkov. Na prv\u00fd poh\u013ead ide o oby\u010dajn\u00e9 obr\u00e1zky, no v ich obrazov\u00fdch d\u00e1tach sa nach\u00e1dza ukryt\u00fd \u0161kodliv\u00fd obsah. T\u00fato techniku pozn\u00e1me ako steganografiu. \u00dato\u010dn\u00edk pri nej ukryje d\u00e1ta do in\u00e9ho s\u00faboru tak, aby na prv\u00fd poh\u013ead nebolo jasn\u00e9, \u017ee sa v \u0148om nach\u00e1dza nie\u010do \u010fal\u0161ie. V tomto pr\u00edpade \u0161kodliv\u00fd PowerShell skript pre\u010d\u00edta hodnoty jednotliv\u00fdch pixelov a z nich posklad\u00e1 ukryt\u00fd bin\u00e1rny s\u00fabor. \u00dato\u010dn\u00edci navy\u0161e rozdelili jednu DLL kni\u017enicu medzi dva obr\u00e1zky. A\u017e po ich stiahnut\u00ed malv\u00e9r jednotliv\u00e9 \u010dasti spoj\u00ed. Po extrakcii obr\u00e1zky odstr\u00e1ni.<\/p>\n

Tak\u00fdto postup m\u00f4\u017ee s\u0165a\u017ei\u0165 klasick\u00fa kontrolu s\u00faborov a z\u00e1rove\u0148 zni\u017euje mno\u017estvo st\u00f4p, ktor\u00e9 po \u00fatoku zostan\u00fa v po\u010d\u00edta\u010di.<\/p>\n

\u00dato\u010dn\u00edci si zabezpe\u010dia n\u00e1vrat do po\u010d\u00edta\u010da<\/p>\n

TerminalFix sa nespolieha iba na jednorazov\u00e9 spustenie \u0161kodliv\u00e9ho k\u00f3du. \u00dato\u010dn\u00edci si vytvoria hne\u010f dva sp\u00f4soby, ktor\u00e9 zabezpe\u010dia jeho op\u00e4tovn\u00e9 spustenie. Prv\u00fd vyu\u017e\u00edva polo\u017eku v registri Windows, ktor\u00e1 dok\u00e1\u017ee automaticky spusti\u0165 program po prihl\u00e1sen\u00ed pou\u017e\u00edvate\u013ea. Druh\u00fd vytvor\u00ed napl\u00e1novan\u00fa \u00falohu, ktor\u00e1 malv\u00e9r spust\u00ed ka\u017ed\u00fdch 60 min\u00fat. \u00dato\u010dn\u00edci z\u00e1rove\u0148 prie\u010dinok s malv\u00e9rom ozna\u010dia ako skryt\u00fd a syst\u00e9mov\u00fd. Be\u017en\u00fd pou\u017e\u00edvate\u013e tak nemus\u00ed na prv\u00fd poh\u013ead vidie\u0165, \u010do sa v po\u010d\u00edta\u010di nach\u00e1dza.<\/p>\n

Po z\u00edskan\u00ed trval\u00e9ho pr\u00edstupu nasleduje f\u00e1za, ktor\u00e1 m\u00f4\u017ee by\u0165 pre napadnut\u00fa organiz\u00e1ciu e\u0161te d\u00f4le\u017eitej\u0161ia. Malv\u00e9r za\u010dne zis\u0165ova\u0165 inform\u00e1cie o po\u010d\u00edta\u010di a jeho okol\u00ed. Skontroluje napr\u00edklad, \u010di je zariadenie s\u00fa\u010das\u0165ou firemnej dom\u00e9ny, vyh\u013ead\u00e1 pou\u017e\u00edvate\u013eov a po\u010d\u00edta\u010de v Active Directory a pok\u00fasi sa n\u00e1js\u0165 \u00fa\u010dty s administr\u00e1torsk\u00fdmi pr\u00e1vami. Zis\u0165uje tie\u017e vz\u0165ahy medzi dom\u00e9nami a sk\u00fa\u0161a komunik\u00e1ciu s vybran\u00fdmi servermi.<\/p>\n

Microsoft uv\u00e1dza, \u017ee medzi h\u013eadanou infra\u0161trukt\u00farou sa nach\u00e1dzali napr\u00edklad dom\u00e9nov\u00e9 radi\u010de, datab\u00e1zov\u00e9 servery, z\u00e1lohovacie syst\u00e9my, br\u00e1ny \u010di po\u0161tov\u00e9 servery. Tak\u00e9to inform\u00e1cie m\u00f4\u017eu \u00fato\u010dn\u00edkovi uk\u00e1za\u0165, \u010di sa dostal do zauj\u00edmav\u00e9ho po\u010d\u00edta\u010da a kam by mohol pokra\u010dova\u0165 \u010falej.<\/p>\n

\u201eOrganiz\u00e1cie by mali napadnut\u00e9 zariadenia pova\u017eova\u0165 za potenci\u00e1lne body, cez ktor\u00e9 m\u00f4\u017ee \u00fato\u010dn\u00edk prenikn\u00fa\u0165 \u010falej do siete,\u201c upozor\u0148uje Microsoft.<\/p>\n

Najzauj\u00edmavej\u0161ou \u010das\u0165ou \u00fatoku je vlastn\u00fd n\u00e1stroj na vytvorenie sp\u00e4tn\u00e9ho tunela. \u00dato\u010dn\u00edci do po\u010d\u00edta\u010da stiahnu Python a vlastn\u00fd program client.py. Ten vytvor\u00ed \u0161ifrovan\u00e9 spojenie so serverom \u00fato\u010dn\u00edkov cez port 443, ktor\u00fd be\u017ene vyu\u017e\u00edva HTTPS. Komunik\u00e1cia n\u00e1sledne prebieha cez WebSocket. Pre pou\u017e\u00edvate\u013ea je d\u00f4le\u017eit\u00e9 najm\u00e4 to, \u010do tak\u00fdto tunel umo\u017en\u00ed. Napadnut\u00fd po\u010d\u00edta\u010d m\u00f4\u017ee fungova\u0165 ako prostredn\u00edk medzi \u00fato\u010dn\u00edkom a vn\u00fatornou sie\u0165ou organiz\u00e1cie.<\/p>\n

\u00dato\u010dn\u00edk teda nemus\u00ed zosta\u0165 iba pri po\u010d\u00edta\u010di, ktor\u00fd p\u00f4vodne napadol. Cez vytvoren\u00fd tunel m\u00f4\u017ee pod\u013ea mo\u017enost\u00ed siete sk\u00fa\u0161a\u0165 komunikova\u0165 s \u010fal\u0161\u00edmi zariadeniami a slu\u017ebami dostupn\u00fdmi z napadnut\u00e9ho po\u010d\u00edta\u010da.<\/p>\n

Microsoft t\u00fato schopnos\u0165 prirovn\u00e1va k SOCKS proxy. Zjednodu\u0161ene povedan\u00e9, napadnut\u00fd po\u010d\u00edta\u010d m\u00f4\u017ee pre \u00fato\u010dn\u00edka fungova\u0165 ako vstupn\u00e1 br\u00e1na do internej siete.<\/p>\n

\u201eT\u00e1to schopnos\u0165 v kombin\u00e1cii s vykonan\u00fdm prieskumom men\u00ed napadnut\u00fd po\u010d\u00edta\u010d na plnohodnotn\u00fd bod pre presun v r\u00e1mci siete,\u201c uv\u00e1dzaj\u00fa bezpe\u010dnostn\u00ed v\u00fdskumn\u00edci Microsoftu.<\/p>\n

Samotn\u00fd Microsoft pritom zd\u00f4raz\u0148uje d\u00f4le\u017eit\u00fa vec, pri analyzovanom \u00fatoku nepozoroval n\u00e1sledn\u00e9 aktivity, ako napr\u00edklad kr\u00e1de\u017e d\u00e1t, vypnutie bezpe\u010dnostn\u00fdch n\u00e1strojov alebo nasadenie ransomv\u00e9ru. Schopnosti \u00fatoku v\u0161ak pod\u013ea v\u00fdskumn\u00edkov vytv\u00e1raj\u00fa priestor na tak\u00e9to \u010fal\u0161ie kroky.<\/p>\n

Ako sa m\u00f4\u017ee\u0161 podobn\u00e9mu \u00fatoku vyhn\u00fa\u0165?<\/p>\n

Najd\u00f4le\u017eitej\u0161ie pravidlo je pritom pomerne jednoduch\u00e9, webov\u00e1 str\u00e1nka od teba nem\u00e1 po\u017eadova\u0165, aby si kv\u00f4li CAPTCHA overeniu otv\u00e1ral PowerShell alebo Windows Terminal a vkladal do\u0148 pr\u00edkaz.<\/p>\n

Ak \u0165a str\u00e1nka vyzve na otvorenie termin\u00e1lu a vlo\u017eenie textu, ide o ve\u013emi siln\u00fd varovn\u00fd sign\u00e1l.<\/p>\n

Microsoft z\u00e1rove\u0148 odpor\u00fa\u010da firm\u00e1m obmedzi\u0165 pou\u017e\u00edvanie PowerShellu pre be\u017en\u00fdch pou\u017e\u00edvate\u013eov, zapn\u00fa\u0165 jeho podrobn\u00e9 zaznamen\u00e1vanie a sledova\u0165 neobvykl\u00e9 sp\u00fa\u0161\u0165anie syst\u00e9mov\u00fdch programov. Pom\u00f4c\u0165 m\u00f4\u017eu aj bezpe\u010dnostn\u00e9 funkcie v Microsoft Defenderi a nastavenia Windows Terminalu, ktor\u00e9 upozornia pou\u017e\u00edvate\u013ea pri vlo\u017een\u00ed viacriadkov\u00e9ho textu.<\/p>\n

V\u00fdskumn\u00edci z\u00e1rove\u0148 odpor\u00fa\u010daj\u00fa d\u00f4kladne preveri\u0165 ka\u017ed\u00fd po\u010d\u00edta\u010d, na ktorom sa podobn\u00e1 aktivita objav\u00ed. Ak \u00fato\u010dn\u00edk vytvoril sp\u00e4tn\u00fd tunel, kompromitovan\u00e9 zariadenie toti\u017e nemus\u00ed predstavova\u0165 iba probl\u00e9m jedn\u00e9ho pou\u017e\u00edvate\u013ea. M\u00f4\u017ee sl\u00fa\u017ei\u0165 aj ako cesta k \u010fal\u0161\u00edm syst\u00e9mom v internej sieti.<\/p>\n


\n
\n
\n
\n
\n
\n P\u00e1\u010dil sa v\u00e1m \u010dl\u00e1nok? Sledujte n\u00e1s na Facebooku
\n
\n <\/a> <\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"Falo\u0161n\u00e1 CAPTCHA od Cloudflare m\u00f4\u017ee vyzera\u0165 ako oby\u010dajn\u00e9 overenie, \u017ee nie si robot. Bezpe\u010dnostn\u00ed v\u00fdskumn\u00edci v\u0161ak upozor\u0148uj\u00fa na…\n","protected":false},"author":2,"featured_media":170354,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_share_on_mastodon":"0"},"categories":[32],"tags":[503,22383,4724,34,37,1928,1534,33,43,48205,40,39,42,41,36,21356,48206,38,35,710,6360,3783,15214],"class_list":["post-170353","post","type-post","status-publish","format-standard","has-post-thumbnail","category-spravy","tag-bezpecnost","tag-clickfix","tag-hackeri","tag-headlines","tag-hlavne-spravy","tag-hrozba","tag-microsoft","tag-news","tag-sk","tag-skodlivy-kod","tag-slovak","tag-slovakia","tag-slovencina","tag-slovensko","tag-spravy","tag-stiahnutie","tag-terminalfix","tag-titulky","tag-top-stories","tag-utok","tag-uzivatelia","tag-varovanie","tag-windows"],"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@sk\/117212606077040723","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/sk\/wp-json\/wp\/v2\/posts\/170353","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/sk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/sk\/wp-json\/wp\/v2\/comments?post=170353"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/sk\/wp-json\/wp\/v2\/posts\/170353\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/sk\/wp-json\/wp\/v2\/media\/170354"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/sk\/wp-json\/wp\/v2\/media?parent=170353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/sk\/wp-json\/wp\/v2\/categories?post=170353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/sk\/wp-json\/wp\/v2\/tags?post=170353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}