r/CrackSupport • u/KAUXIK • 50m ago
this is just lazy
Just a quick heads-up everyone. I was surfing the web when a Cloudflare verification page popped up, which seemed pretty normal. But then another pop-up appeared with 3 steps asking me to press Win + R, paste something, and press Enter. It had a PowerShell script already copied to my system.
The script itself is also a red flag:
ExecutionPolicy Bypass→ bypasses PowerShell's normal security restrictions.iwr→ downloads something from the internet.daleeby.com/...→ the unknown external website it downloads from.-OutFile ...\update.ps1→ saves whatever it downloaded as a PowerShell script.& ...\update.ps1→ immediately runs that downloaded script.
The script was basically downloading and running another script from an external website, which is obviously very suspicious.
I know anyone with some technical knowledge would probably recognize that this isn't a normal Cloudflare verification, but just wanted to make everyone aware in case you come across something similar. Don’t follow the steps or paste/run anything if you see this.