A dentist's website displays a "verify you are human" checkbox, but clicking it shows instructions to open PowerShell and press Ctrl+V when a confirmation prompt appears. It seems the checkbox copies a command string to the clipboard and then encourages the visitor to paste it into PowerShell. The string begins with "SilentlyContinue." Is this a known attack, and what should I do?
3 Answers
The website itself, an injected advertisement, or a compromised third-party script may be responsible. The office’s hosting provider or webmaster should be told exactly what page and steps triggered the prompt, preferably using contact information obtained independently rather than anything displayed by the suspicious page.
As long as you only clicked the checkbox and did not execute the copied command, you’re probably fine. Clear the page, avoid returning to it, and consider checking the site URL with a reputable security scanner. If you did run anything, disconnect the computer from the internet and get it checked immediately; changing important passwords from a clean device may also be necessary.
Yes, this is almost certainly a ClickFix-style malware or credential-theft attack. Legitimate CAPTCHA systems will never ask you to open PowerShell, use the Run dialog, or paste commands from your clipboard. Do not run or paste the command. Close the page and contact the dental office through a trusted phone number so they can investigate their website.
The exact command usually isn’t useful to analyze safely because these attacks often download a second-stage payload. The important point is not to paste it into PowerShell or any other prompt.