4 ms·
In Windows CMD you don’t even need to hit return at the end. They can just add a line break to the copied text and as soon as you paste into the command line (j
by wvbdmp 1y ago
In Windows CMD you don’t even need to hit return at the end. They can just add a line break to the copied text and as soon as you paste into the command line (just a right click!), you own yourself.
I have one question though: Considering the scare-mongering about Windows 10’s EOL, this seems pretty convoluted. I thought bad guys could own your machine by automatic drive-by downloads unless you’re absolutely on the latest versions of everything. What’s with all the “please follow this step-by-step guide to getting hacked”?
- Levitz 1y ago>What’s with all the “please follow this step-by-step guide to getting hacked”? Far from an expert myself but I don't think this attack is directed at windows users. I don't think windows even has base64 as a command by default?
- tgsovlerkhgsel 1y agoI'm pretty sure this attack checks your user agent and provides the appropriate code for your platform.
- bilkow 1y agoThere's a variant of these for Windows: https://www.malwarebytes.com/blog/news/2025/03/fake-captcha-websites-hijack-your-clipboard-to-install-information-stealers https://www.malwarebytes.com/blog/news/2025/03/fake-captcha-... It involves no CMD though, it's basically just Win+R -> CTRL+V -> Enter
- tgsovlerkhgsel 1y agoI'm sure "visit a site and get exploited" happens, but... I haven't actually heard of a single concrete case outside of nation-state attacks. What's more baffling is that I also haven't heard of any Android malware that does this, despite most phones out there having several publicly known exploits and many phones not receiving any updates. I can't really explain it except "social engineering like this works so well and is so much simpler that nobody bothers anymore".
- rcruzeiro 1y agoOh the Internet Explorer 6 + ActiveX days…
- deleted 1y ago[deleted]
- taneliv 1y agoOld Androids do reportedly, and from experience, get slower over time. Maybe that's just bloat in the user installed apps when they are updated. But I would not be terribly surprised if it wasn't also malware consuming resources.
- account42 1y agoWould you know when it happens? It's not like the malware will throw up a giant message box telling you that you have been pwned - unless it's a cryptolocker or other extortion campaign but even then it will likely not activate immediately to evade analysis. But yes, zero days are too valuable to waste on random targets. Doesn't mean it never happens.