On pinnacleradio-net.edmimwa.com, Radar observed a fake verification widget attempt to copy a command, then show Windows PowerShell and paste instructions. The command was intercepted; it was never run.
Daily critical finding · observed
Play walkthroughPause / collapse walkthrough
The retained baseline screenshot shows an imitation reCAPTCHA-style checkbox over a dimmed page. Its appearance alone is not the decisive evidence.
After one constrained verification click, Radar intercepts the original page's clipboard write containing a PowerShell retrieval-and-execution pipeline.
The next retained screenshot tells the visitor to press Win+X, choose Windows PowerShell or press I, paste with Ctrl+V, then press Enter.
Radar retains the command as inert review text and the instruction screenshots. It never follows the operating-system steps or runs the captured command.
Illustrated evidence sequence — not a recording of the website. No commands are run. Reduced-motion mode shows static steps.
What Radar observed
In the original isolated browser session, one constrained verification click triggered navigator.clipboard.writeText with a 119-character PowerShell command. It used Invoke-RestMethod to retrieve content from cosmical2049[.]com and pipe it to Invoke-Expression. Retained before-and-after screenshots show a robot-check lure followed by Win+X, PowerShell, Ctrl+V and Enter instructions.
Why it matters
This is a ClickFix handoff: a familiar verification prompt tries to persuade the visitor to move from a web page into an operating-system command interface. The intercepted command would retrieve remote content and pass it to an execution function if a person ran it. Radar observed the copy attempt and instructions, not payload execution or an infected device.
Observation limits
Evidence is from the 26 October scan, not a claim about the site's current state or every visitor. The clipboard attempt occurred in the original isolated page session. Request and event limits were reached, one screenshot failed, and a referenced script returned HTTP 403. Some RPC responses were withheld from page execution; the complete downstream chain remains unobserved. No command was pasted or executed.
Recommended response
Do not follow verification instructions that ask you to open Run, Terminal or PowerShell and paste a command. Close the page and report the source through your security process. Defenders can investigate the captured destination cosmical2049[.]com and consult the source report for the exact command and context. If someone already ran it, isolate the device and begin incident response; this scan does not establish execution.
Evidence reflects the scan time. A compromised website can change or be repaired; this is not an assertion about every visitor or its current state.