Fake Cloudflare verification on deceased influencer’s site drops a PowerShell shellcode loader

I was checking the website (felzenergy.com) of an influencer (Joe Felz) who recently passed away and had been researching “free energy.” The site currently shows a fake Cloudflare-style verification that tells visitors to run a PowerShell command to prove they’re human. I pulled the payload without executing it. The first stage downloads another blob from the same IP, allocates RWX memory with VirtualAlloc, copies the payload into memory, and runs it with CreateThread. So the chain is basically: fake verification -> PowerShell -> downloaded shellcode -> RWX memory -> CreateThread I have not detonated the second stage. I also have no evidence this has anything to do with his death or research; the site may simply have been compromised. If anyone is able to check it out and report back on what that is, that'd be much appreciated. https://preview.redd.it/zmnhmti687ih1.png?width=1108&format=png&auto=webp&s=1dcb632d5fdad0e68d58f61b7863db76b91eda52 https://preview.redd.it/mrpwxv7787ih1.png?width=996&format=png&auto=webp&s=8fc932ccbac3b70097b24fbdfc42d316bbfe55d9 submitted by /u/ThiccLatinaBabe [link] [comments]

from hacking: security in practice https://ift.tt/WanVCFv