A script fetched during Radar’s wtdistributors[.]com scan revealed a ClickFix sequence in a separate offline browser experiment: a robot-check lure, a copied PowerShell command and instructions to paste it into a terminal. Radar did not run the command.
Daily critical finding · observed
Play walkthroughPause / collapse walkthrough
Radar retained a browser stage from the scan and inspected it in a separate network-denied context. This illustration is not footage of the original site.
A bounded interaction triggered one intercepted clipboard write. The text contains a remote retrieval and execution chain; no OS command ran.
The captured stage tells the visitor to open PowerShell or Terminal, paste with Ctrl+V and press Enter. Radar captured these instructions without following them.
Illustrated evidence sequence — not a recording of the website. No commands are run. Reduced-motion mode shows static steps.
What Radar observed
The original session fetched a browser stage through an RPC endpoint. In a separate network-denied browser context, one bounded interaction intercepted a command-like clipboard write. Retained before/after screenshots show an imitation verification widget and Windows terminal/paste instructions. The same command text was also visible in the comparison source’s earlier report.
Why it matters
The decisive evidence is the combination of deceptive human-verification instructions and a command copied for terminal execution. This is different from an openly labelled software-install command. The captured text uses PowerShell retrieval and execution aliases and points to fastly.jsdelivr[.]net; that shared CDN hostname alone is not a reason to block all of its users.
Observation limits
The scan began on 29 October 2026 at 23:35 UTC. The clipboard write and instruction screenshots came from a separate offline stage, not the original visitor session. Seven requests were blocked during that experiment. The original page was only partially rendered. Radar did not paste or execute the command, retrieve its downstream payload or establish infection.
Recommended response
Close pages that ask you to open Terminal or PowerShell to prove you are human. Defenders should use the public report’s full command and observation context to investigate the specific destination path, rather than blanket-block a shared CDN. If a command was already executed on a device, follow your organisation’s incident-response process.
Evidence reflects the scan time. A compromised website can change or be repaired; this is not an assertion about every visitor or its current state.