What Would This Fake Human-Verification PowerShell Command Do?

If anyone did execute it, disconnect the computer from the network and perform a full scan from a trusted security tool. From a separate clean device, change important passwords, revoke active sessions, and enable multifactor authentication. If there are signs of ongoing compromise, restoring from a known-clean backup or reinstalling Windows may be safer than trying to remove everything manually.

These campaigns commonly deploy information stealers. They may copy saved passwords, browser session cookies, autofill data, cryptocurrency-wallet files, and other sensitive information. Stolen session cookies can sometimes let an attacker access accounts without knowing the password, so affected accounts may need password resets and sign-out of all sessions if the command was ever run.

This is a fake verification trick. The command downloads a remote script and executes it, so the attacker could make it do essentially anything, including installing malware, creating persistence, or stealing files and browser data. The execution-policy bypass is another major warning sign. If you never ran it, simply closing the page should mean the command did not execute.