What Would This Fake Human-Verification PowerShell Command Do?
Asked by
MellowCedar42
I found a website that displayed a "human verification" prompt. After clicking the checkbox, it instructed me to press Win+R and paste a PowerShell command. The command downloads a file from the internet into the Windows temporary folder, then runs it with PowerShell execution-policy restrictions bypassed. I closed the page instead of running it, since it looked suspicious. What could this command do if someone executed it, and what precautions should I take to protect a shared family PC from similar scams?
Answers
This is a fake verification trick. The command downloads a remote script and executes it, so the attacker could make it do essentially anything, including installing malware, creating persistence, or stealing files and browser data. The execution-policy bypass is another major warning sign. If you never ran it, simply closing the page should mean the command did not execute.
Reply to this answer
These campaigns commonly deploy information stealers. They may copy saved passwords, browser session cookies, autofill data, cryptocurrency-wallet files, and other sensitive information. Stolen session cookies can sometimes let an attacker access accounts without knowing the password, so affected accounts may need password resets and sign-out of all sessions if the command was ever run.
Reply to this answer
If anyone did execute it, disconnect the computer from the network and perform a full scan from a trusted security tool. From a separate clean device, change important passwords, revoke active sessions, and enable multifactor authentication. If there are signs of ongoing compromise, restoring from a known-clean backup or reinstalling Windows may be safer than trying to remove everything manually.
Reply to this answer
The safest rule is never to paste commands from a webpage into Run, Command Prompt, or PowerShell just to pass a CAPTCHA or “prove you’re human.” Real verification pages do not need you to run a command. Make sure Windows and the browser are updated, keep security protection enabled, and explain to everyone using the computer that these prompts are scams.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions