u/KAUXIK

Just a quick heads-up everyone. I was surfing the web when a Cloudflare verification page popped up, which seemed pretty normal. But then another pop-up appeared with 3 steps asking me to press Win + R, paste something, and press Enter. It had a PowerShell script already copied to my system.

The script itself is also a red flag:

• ExecutionPolicy Bypass → bypasses PowerShell's normal security restrictions.
• iwr → downloads something from the internet.
• daleeby.com/... → the unknown external website it downloads from.
• -OutFile ...\update.ps1 → saves whatever it downloaded as a PowerShell script.
• & ...\update.ps1 → immediately runs that downloaded script.

The script was basically downloading and running another script from an external website, which is obviously very suspicious.

I know anyone with some technical knowledge would probably recognize that this isn't a normal Cloudflare verification, but just wanted to make everyone aware in case you come across something similar. Don’t follow the steps or paste/run anything if you see this.