A single compromised account on the veteran tech publication was enough to expose visitors to a script-injection campaign distributing NetSupport RAT.
Summary
- A compromised Gizmodo account was used to inject a malicious script that displayed fake CAPTCHA prompts — a ClickFix technique — to site visitors.
- The campaign is attributed to an affiliate of ErrTraffic, a ClickFix-as-a-service platform that lets operators deliver malware of their choosing.
- Windows users were targeted with NetSupport RAT, which can enable remote access, file exfiltration, and delivery of additional payloads including ransomware.
- The macOS payload was present but broken at the time of the incident, apparently requiring a password that was not supplied.
- Gizmodo took the site offline, removed the script, and secured the account; The Register confirmed the prompts were no longer active by Monday.
What happened
Gizmodo confirmed over the weekend that a compromised account on its platform was exploited to inject a malicious script into article pages. Readers reported seeing fake CAPTCHA windows — the hallmark of a ClickFix social-engineering lure — and shared screenshots publicly before the outlet acted. Gizmodo’s own statement acknowledged the incident directly: “A compromised account was exploited to inject a malicious script, briefly exposing users to scam content.”
The ClickFix technique
ClickFix works by presenting a convincing fake verification prompt that instructs users to copy and paste a command into their system terminal or run dialog. The goal is to bypass traditional malware delivery controls by making the victim execute the payload themselves. It requires no drive-by exploit of a browser vulnerability — only a moment of inattention from a user who believes they are completing a routine check.
ErrTraffic and the affiliate model
Proofpoint threat researcher Tommy M attributed the campaign to an affiliate of ErrTraffic, a ClickFix-as-a-service operation. Like other as-a-service models in the criminal ecosystem, ErrTraffic allows affiliates to plug in their chosen malware payload while the platform handles the delivery infrastructure. The prompt itself was configured to tailor the lure based on the visitor’s operating system, indicating a degree of operational care from the affiliate.
Payloads: NetSupport RAT on Windows
On Windows, the script attempted to install NetSupport RAT — malware that abuses the legitimate NetSupport Manager remote access tool to establish unauthorised control of an affected system. According to Darktrace, NetSupport RAT is capable of exfiltrating files and loading secondary payloads, including other malware strains and ransomware. The use of a genuine commercial tool for the underlying access mechanism complicates detection, since NetSupport Manager traffic can appear routine in environments where the legitimate product is in use.
macOS payload present but non-functional
A payload was also configured for macOS users, though it appeared to be broken at the time of the incident. The ZIP archive carrying the payload was password-protected, and the password was not provided as part of the prompt, rendering it inoperable. Whether this reflects an error by the affiliate or an incomplete stage of the campaign is not known from available sources.
Timeline and containment
User reports of the malicious prompts spanned only a few hours on Saturday. Gizmodo stated it took the site offline immediately upon identifying the issue, removed the script, and secured the compromised account. The Register independently verified that the site was no longer serving ClickFix prompts as of Monday. The brief window of exposure limits the potential scope of the incident, though the number of visitors who may have encountered and acted on the prompt during that period has not been disclosed.
Why it matters
This incident is a practical illustration of supply-chain and third-party risk that sits outside most organisations’ direct control. Your staff and executives routinely browse reputable, well-known publications — including technology media — as part of their working day. A single compromised CMS account on a trusted site can turn legitimate editorial content into a delivery vehicle for remote access tooling and potential ransomware staging. The ClickFix technique is particularly relevant for CISOs to understand because it sidesteps endpoint controls that focus on file downloads and browser exploits; the user is the execution mechanism. Organisations that rely on perimeter or signature-based controls alone will not catch a user typing a command into their own terminal at the prompt of a convincing fake CAPTCHA. The as-a-service nature of ErrTraffic also signals that this technique will continue to proliferate — lower technical barriers mean more affiliates, more campaigns, and more legitimate sites as unwitting vectors.
What to do now
- Brief end users and IT staff on the ClickFix social-engineering technique: legitimate sites do not ask visitors to run commands in a terminal or the Windows Run dialog to pass a CAPTCHA.
- Review endpoint detection coverage for NetSupport RAT and similar tools that abuse legitimate remote access software; ensure detections are not solely reliant on file signatures.
- If users visited Gizmodo during Saturday’s incident window and followed any on-screen instructions, treat affected devices as potentially compromised and investigate accordingly.
- Remind users that encountering an unexpected prompt — even on a familiar, trusted website — is sufficient reason to close the tab and report the behaviour to the security team.
- For organisations that operate web properties with multiple content contributors, audit account access controls on CMS platforms and enforce MFA to reduce the risk of a single compromised account enabling script injection.
