On turboexcel247[.]com, a fake verification prompt attempted to copy a hidden command, then displayed Windows PowerShell and paste instructions. Radar intercepted the command without running it.
Daily critical finding · observed
Play walkthroughPause / collapse walkthrough
The retained baseline shows a checkbox-style verification prompt over a dimmed page. Its appearance alone is not the decisive evidence.
Radar intercepts the original page attempting to copy a PowerShell retrieval-and-execution pipeline. The complete command is retained as inert evidence.
The instruction screenshot says Win+X, choose Windows PowerShell or press I, paste with Ctrl+V, then Enter. This is a system-command handoff.
Radar keeps the command and screenshots without following the Windows steps, pasting the command or executing it. The downstream payload remains unobserved.
Illustrated evidence sequence — not a recording of the website. No commands are run. Reduced-motion mode shows static steps.
What Radar observed
In the original isolated browser session, the page attempted a command-like clipboard write about 35 seconds into observation. The retained PowerShell pipeline retrieves content from lepafonso[.]bz and passes it to Invoke-Expression if executed. Reviewed screenshots show a checkbox lure followed by Win+X, Windows PowerShell, Ctrl+V and Enter instructions.
Why it matters
The evidence is the deceptive handoff from browser verification to a system command interface, together with an intercepted hidden command. This supports ClickFix delivery in the observed session. A logo or risk score alone would not establish an attack. Radar did not execute the command or establish that any visitor was infected.
Observation limits
Evidence was captured on 1 November UTC, within the previous 24 hours. The request budget and read-only RPC inspection limit were reached. Some RPC responses were withheld from page execution and a complete safe script reference could not be derived. The downstream payload remains unobserved. The walkthrough is a labelled illustration, not a recording or private paid clip.
Recommended response
Close verification pages that ask you to open Run, Terminal or PowerShell and paste text. Preserve the source report and notify your security team. Defenders can investigate lepafonso[.]bz with the captured command and context. If someone already executed the command, isolate the device and begin incident response.
Evidence reflects the scan time. A compromised website can change or be repaired; this is not an assertion about every visitor or its current state.