On georgespizzas[.]com, Radar observed a fake robot check attempt to copy a hidden PowerShell command, followed by Windows paste instructions. The intercepted command exactly matches the source report; it was never executed.
Daily critical finding · observed
Play walkthroughPause / collapse walkthrough
The retained baseline screenshot shows an imitation reCAPTCHA-style checkbox over a dimmed page. Its appearance alone is not the decisive evidence.
The original page attempts a command-like clipboard write. Radar intercepts a PowerShell retrieval-and-execution pipeline targeting cosmical2049[.]com.
The retained final image says Win+X, choose Windows PowerShell or press I, paste with Ctrl+V, then press Enter. These are not normal browser-verification steps.
Radar retains inert command text and the instruction screenshots. It never follows the operating-system steps, pastes the command or executes it.
Illustrated evidence sequence — not a recording of the website. No commands are run. Reduced-motion mode shows static steps.
What Radar observed
In the original isolated browser session, a bounded verification interaction triggered a command-like clipboard write about 24 seconds into observation. The captured PowerShell pipeline uses Invoke-RestMethod to retrieve content from cosmical2049[.]com and passes it to Invoke-Expression. Reviewed screenshots show an imitation robot checkbox followed by Win+X, Windows PowerShell, Ctrl+V and Enter instructions.
Why it matters
The decisive evidence is the handoff from a web verification prompt to an operating-system command interface, together with the intercepted hidden command. This establishes ClickFix command delivery in that session. A familiar logo or a suspicious score alone would not establish an attack, and the scan does not establish execution or an infected device.
Observation limits
Evidence reflects the 28–29 October UTC observation, not every visitor or the current site state. Request and event limits were reached; some RPC responses were withheld from page execution, read-only RPC inspection reached its limit, and a referenced script returned HTTP 403. The full downstream chain remains unobserved. This walkthrough is an illustration, not a recording or paid clip.
Recommended response
Close verification pages that ask you to open Run, Terminal or PowerShell and paste text. Report the source and preserve the public Radar evidence. Defenders can investigate cosmical2049[.]com and consult the source report for the exact captured command. If someone already executed it, isolate the device and begin incident response; Radar did not execute it.
Evidence reflects the scan time. A compromised website can change or be repaired; this is not an assertion about every visitor or its current state.