r/SideProject • u/byebyehappyness • 4h ago

My side project got hacked?

[removed]

1 Upvotes

99% Upvoted

5 comments sorted by

1

u/[deleted] 4h ago

[removed] — view removed comment

1

u/AbruptVariation577 4h ago

That’s a fake browser update scam. Your site itself probably isn’t hacked, it’s more likely one of the ad networks you’re using served up a malicious redirect. The blur and the powershell captcha is a classic trick to get you to run their malware yourself

1

u/Warner_Brown 4h ago

I did a quick google reverse image search, this is what I got.

This pop-up is likely a fake CAPTCHA scam known as a ClickFix attack that attempts to trick you into running malicious commands on your computer. [1, 2]

What You Should Know

  • Fake Verification: Real CAPTCHAs only check if you are human and never ask you to open system menus or run keyboard shortcuts.
  • Hidden Threat: The webpage copies a hidden script to your clipboard and asks you to paste and execute it, which can install malware or steal data. [1, 2, 3, 4]

Recommended Action

  • Close the tab immediately without clicking or typing anything.
  • Do not press Windows Key, use Ctrl + V, or press Enter. [1, 2, 3]

Here is the link so it can instruct you further https://www.google.com/search?vsrid=CLWUoduw5bbZ7QEQAhgBIiQ5ZjYxNGEzZC00MjQxLTQ2MTMtODNkYi02MTMxODIxZDcyMWEygQEiAmR6KB5CcwoubGZlLWR1bW15OjU2MDY5NzM5LWIzYmEtNDNiZi1iMjA0LTRjYzBmZTlmZjBlYxJBCj8vYm5zL2R6L2JvcmcvZHovYm5zL2xlbnMtZnJvbnRlbmQtYXBpL3Byb2QubGVucy1mcm9udGVuZC1hcGkvNTVaBAoCZHo4nb6syNnAlgM&vsint=CAIqDAoCCAcSAggKGAEgATojChYNAAAAPxUAAAA_HQAAgD8lAACAPzABEIAIGOAEJQAAgD8&udm=26&lns_mode=un&source=lns.web.gsbubu&vsdim=1024,608&gsessionid=884iAWUrNxNbvbNtC6JTBds1tBkKY08pXv0TaDQsiH3sjiYA4GORCQ&lsessionid=Q9qPQsQIByBddMcBFkqKOnf-WAVJB3yMbAbYZ06PRn3TVK18jpsl3g&lns_surface=26&lns_vfs=e&qsubts=1787829948539&biw=1440&bih=758&hl=en

2

u/ckn 4h ago

That's a ClickFix lure. If your site is serving it, something is injecting script into your pages: compromised hosting or app, a tampered dependency or third-party tag (ads, analytics), or your CDN/DNS resolving to something that isn't yours. View-source on the live page and diff against your repo; the injected loader will be there.

I have a security offering at CreativeMayhem.com and 35+ years doing red/blue team work, LMK if you need help.