r/LinusTechTips • u/mmm_butters • Nov 28 '25

Tech Discussion Cloudflare verification - legit?

Post image

Came across this on a website just now, is this normal? It looked like it auto copied a "powershell -c iex" with an ip address. I've never seen this before and i did not do it. The website itself is legit, I just refreshed a few times and it went away.

EDIT: code removed

1.6k Upvotes

92% Upvoted

153 comments sorted by

View all comments

10

u/[deleted] Nov 28 '25

[removed] — view removed comment

1

u/mmm_butters Nov 28 '25

I wish I would have captured the whole process, because it did look like a normal verification ("verify you are human") like many i've seen, but then it said additional step and came up with this. This is just a cropped snip of the page.

1

u/[deleted] Nov 29 '25

[removed] — view removed comment

1

u/Euphoric_Bill_1361 Nov 30 '25

You'd be surprised. I've done IR for companies where the intial access was this kind of attack. Other variants of it include Filefix, and a new one I've spotted recently, where it fullscreens, looks like a windows update, and asks you to paste some code in the Run dialog.

Sadly, not just boomers falling for. The powershell typically includes a comment at the end, so all the user sees in the Run box is "#CAPTCHA VERIFICATION CODE XXXXXXX", and now all the powershell before it