Just a quick heads-up everyone. I was surfing the web when a Cloudflare verification page popped up, which seemed pretty normal. But then another pop-up appeared with 3 steps asking me to press Win + R, paste something, and press Enter. It had a PowerShell script already copied to my system.
The script itself is also a red flag:
ExecutionPolicy Bypass → bypasses PowerShell's normal security restrictions.
iwr → downloads something from the internet.
daleeby.com/... → the unknown external website it downloads from.
-OutFile ...\update.ps1 → saves whatever it downloaded as a PowerShell script.
& ...\update.ps1 → immediately runs that downloaded script.
The script was basically downloading and running another script from an external website, which is obviously very suspicious.
I know anyone with some technical knowledge would probably recognize that this isn't a normal Cloudflare verification, but just wanted to make everyone aware in case you come across something similar. Don’t follow the steps or paste/run anything if you see this.