I encountered a fake Cloudflare verification page on a website I had used before. It told me to press Win+R and then Ctrl+V, which pasted a script into the Windows Run dialog. I unfortunately pressed Enter, but Microsoft Defender immediately blocked a threat. I saw no Command Prompt or PowerShell window afterward. I disconnected from the internet, closed the browser, ran a Microsoft Defender Offline scan, then completed full scans with Defender and Malwarebytes. Nothing was detected. I also checked Task Scheduler, Event Viewer, installed programs, cookies, and site data, and reset my passwords from another device while signing out other sessions. What was the script intended to do, and is there anything else I should check?
3 Answers
The command appears to create a scheduled task named something like “ENTE” that runs every minute. The task launches PowerShell, uses Invoke-RestMethod to download content from a remote server, and then uses Invoke-Expression to execute whatever was downloaded. In other words, it was designed to establish persistence and repeatedly fetch and run a payload. Check Task Scheduler carefully for that task or anything created around the time of the incident. If Defender prevented the command from running, it may have stopped the attack before the task was created, but there is no way to prove that from the script alone.
For maximum confidence after executing an unknown PowerShell payload, back up personal documents only and perform a clean Windows reinstall using installation media created on a trusted computer. That is more thorough than relying on scans, especially if the payload might have stolen sessions or modified system settings. If you choose not to reinstall, keep monitoring account-login alerts, review scheduled tasks and startup entries, and avoid signing into sensitive accounts from that PC until you are satisfied it is clean.
This looks consistent with a cookie or session stealer. These attacks may target browser cookies, saved credentials, password managers, and active login sessions. Changing passwords was good, but make sure you changed them from a known-clean device, enabled MFA where possible, and revoked existing sessions and application tokens. Also check important email accounts for unexpected forwarding rules, recovery addresses, or new app authorizations.
I reset the passwords from another device and signed out the other sessions. I’ll also check email forwarding and connected applications, since I hadn’t considered those.
I checked for “ENTE” and similarly named tasks, including tasks created around that time, and found nothing suspicious. I also ran full scans with Defender, Malwarebytes, and another scanner, all of which came back clean. Definitely a lesson learned about pasting commands from websites.