On kishvekush[.]com, Radar observed a fake robot check change into Windows PowerShell paste instructions while the page attempted a command-like clipboard write. The write was intercepted; no command was run.
Daily critical finding · observed
Play walkthroughPause / collapse walkthrough
The retained baseline shows a reCAPTCHA-style checkbox over a dimmed page. Its appearance alone is not the decisive evidence.
Radar records hidden loader code and public RPC traffic while keeping the returned stage away from normal page execution.
The runtime event and final frame show a copied verification code followed by Win+X, PowerShell, Ctrl+V and Enter instructions.
Radar retains the evidence but never pastes or runs the command. Payload behavior and endpoint impact remain unverified.
Illustrated evidence sequence — not a recording of the website. No commands are run. Reduced-motion mode shows static steps.
What Radar observed
The original isolated browser session retained three readable frames: a counterfeit reCAPTCHA-style checkbox, a runtime clipboard event, and Win+X, Windows PowerShell, Ctrl+V and Enter instructions. Concealed page code also contacted public blockchain RPC services and constructed a full-screen external iframe loader.
Why it matters
The decisive evidence is the same-session handoff from browser verification to an operating-system command interface, together with an intercepted command-like clipboard write. That supports ClickFix delivery. Blockchain RPC use and obfuscation add context but would not prove an attack by themselves.
Observation limits
This is a point-in-time observation from 7 November UTC. The browser request budget and read-only RPC inspection limit were reached, the RPC response was withheld from page execution, and no complete downstream script reference was derived. Radar did not paste or execute the command, retrieve its payload or establish infection. The walkthrough is a labelled illustration, not a recording.
Recommended response
Close verification pages that ask you to open Run, PowerShell or Terminal and paste text. Preserve the report and notify your security team. If someone already followed the steps, isolate the device and begin incident response. Review the specific captured indicators rather than blocking shared RPC providers wholesale.
Evidence reflects the scan time. A compromised website can change or be repaired; this is not an assertion about every visitor or its current state.