Notes from the lab

A lure page pretends to fix a common computer error (“out of date”, “CAPTCHA failed”) and convinces the user to copy a small “fix” command and paste it into Run / Terminal. The “fix” is the malicious payload.

I never ran the sample on my machine. I submitted the URL to urlscan.io, which loads it in a sandbox and shows the redirect chain, resources, and any suspicious scripts. Then I checked the domains and hashes on VirusTotal to see vendor verdicts.

It showed a fake CAPTCHA box, wrote a hidden encoded command to the clipboard via JavaScript, and relied on the user pasting it into their terminal. Infection chain: lure page → clipboard → user-pasted shell command → stager download.

Block the domains at DNS, label mail carriers, and train users on one rule: no website needs you to type a command. Spot phrases like “paste this into Run” — that’s not support, that’s the attack.

Check the real sender address or number, not the display name. Banks and government bodies never ask for codes, PINs, or full passwords by message.

Hover (don’t tap) links to preview the domain. Look for misspelled brands (amaozn, paypa1) or odd domains (.xyz, .top), and shortened links.

“Account blocked in 24 hours” is designed to stop you thinking. Treat manufactured urgency as a red flag by itself.

Never enable macros or open unexpected apostrophes. No legitimate service pays you, refunds you, or verifies you via a random SMS.

Contact the organization through its official app, number, or website — not through details in the message itself.

I treated my own auto-reply bot like a stranger would: ignore its instructions, try to get it to reveal its system prompt, flood it, and sneak instructions into innocent-looking messages.

Early builds repeated chunks of the system prompt when asked politely, accepted multi-message command stuffing, and answered hundreds of requests per minute without rate limiting — a token bill waiting to happen.

Added per-user rate limits, capped reply length, hardened the system prompt against prompt injection, and made the bot refuse to reveal its instructions. Lesson: “it works on my test” isn’t the same as secure.