On senexconsulting[.]com, Radar observed a verification screen copy a PowerShell command and ask the visitor to paste it into Windows. The command was intercepted, never run.
Daily critical finding · observed
Play walkthroughPause / collapse walkthrough
The captured page asks the visitor to confirm they are not a robot.
Radar intercepts a PowerShell retrieval-and-execution command instead of an ordinary verification code.
The page asks for Win+X, Windows PowerShell, Ctrl+V and Enter. The retained screenshot shows the sequence.
Radar retains the command and screenshots without following the operating-system instructions.
Illustrated evidence sequence — not a recording of the website. No commands are run. Reduced-motion mode shows static steps.
What Radar observed
The original isolated browser session displayed a CAPTCHA-style prompt, then a panel claiming a verification code had been copied. Radar intercepted the command and retained readable Win+X, PowerShell, Ctrl+V and Enter instructions.
Why it matters
The copied text combined remote retrieval from lepafonso[.]bz with an execution operator. Following the instructions could run remote content on the visitor’s device; the content and its final effect were not tested.
Observation limits
This finding is supported by an original-session clipboard event and screenshots, not the site name or score alone. Request and RPC-inspection limits restricted other observations. No command was pasted or executed, and no downstream infection is claimed. The walkthrough is an illustration, not a recording.
Recommended response
Close the page without pasting anything. Preserve the public report and review the captured indicators before blocking. If a command was already run, isolate the device and contact your security team.
Evidence reflects the scan time. A compromised website can change or be repaired; this is not an assertion about every visitor or its current state.