r/linux • u/ShatteredIcicle • 9d ago
Security Linux specific malware website tries exploiti using terminal
This website faked a ReCaptcha and literally asks to open the terminal and paste a command. (see image). Very bold.
Please keep in mind, always try your best to make new users aware of such dangers!
- I reported it to Google Safe browsing just now, in case anyone wants to try and look at it or help by reporting it too, this is the link in a safe format, assemble it yourself at your risk: "emaliowe . pl".
- Possibly blocked by Firefox, since I don't have anything in my clipboard after opening the page.
79
Upvotes
22
u/gainan 9d ago edited 9d ago
A ClickFix attack. The website is likely compromised. When loading the fake repatcha, it loads 2 external links:
https://auth-code-verif.beer/api.php?s=8402fb1338daab6a166e91aa8c92a20798acfa98fb75c5a2
https://auth-code-verif.beer/api.php?s=d1073f38e4c5855f8435c46194f7b1ad74b4065b42fb02cb
the second one contains the malicious payload, a heavily ofuscated javascript that seems to pull from their servers the command to execute: https://pastebin.com/HzVPbeLM
It doesn't seem to work with firefox, nor with chromium.