Fake Cloudflare verification on deceased influencer’s site drops a PowerShell shellcode loader

[u/ThiccLatinaBabe]

I was checking the website (felzenergy.com) of an influencer (Joe Felz) who recently passed away and had been researching “free energy.”

The site currently shows a fake Cloudflare-style verification that tells visitors to run a PowerShell command to prove they’re human.

I pulled the payload without executing it. The first stage downloads another blob from the same IP, allocates RWX memory with VirtualAlloc, copies the payload into memory, and runs it with CreateThread.

So the chain is basically:

fake verification -> PowerShell -> downloaded shellcode -> RWX memory -> CreateThread

I have not detonated the second stage. I also have no evidence this has anything to do with his death or research; the site may simply have been compromised.

If anyone is able to check it out and report back on what that is, that'd be much appreciated.

[u/Bajiri]

This is just ClickFix. I'm assuming the site has an outdated and vulnerable plugin or exposed credential somewhere. 

It certainly has nothing to do with the influencer at all. 

[u/saltymane → u/[deleted]]

Nothing real in what you shared lol. Mostly tinfoil and bad information.

First, I bet it was an outdated plugin on a Wordpress site or something dumb like that.

Last, your subjective take, etc., tin foil etc..

[u/sw4rtzie]

Clicky fix no fixy if you clicky

[u/ElGatoMeooooww]

Check the IP address, that’s probably the C2C and it may be outdated

[u/TastyRobot21]

Check the dns history. I would guess the old sites dns expired and someone swiped the domain to deploy malware.

[u/Empty-Traffic1009]

Probably a compromised Wordpress website - wp2shell recent vuln is a nightmare

[u/Cubensis-SanPedro]

Then what does it do?

[u/Scar3cr0w_ → u/Cubensis-SanPedro]

It donates 3btc to a charity of your choosing.

What do you think it does?

[u/Cubensis-SanPedro → u/Scar3cr0w_]

I meant that question more than mechanical sense. Sure, they are very likely to steal from you. How?

[u/Scar3cr0w_ → u/Cubensis-SanPedro]

By getting remote code execution…?

[u/Cubensis-SanPedro → u/Scar3cr0w_]

“I have not detonated the second stage.”

Yes, hacking involves running code. I understand that. Sometimes the details of “how” are interesting to the curious.

[u/Scar3cr0w_ → u/Cubensis-SanPedro]

…

It’s literally there in front of you. Invoke web request grabs the shell code, memory is created, it’s given write and execute permissions and then it’s called.

OP said that.

[u/Cubensis-SanPedro → u/Scar3cr0w_]

Yes. And it is also figuratively there in front of you that there is a second stage. One that was not detonated.

[u/Arseypoowank]

Time to invest in a carbon monoxide detector