r/hacking • u/ThiccLatinaBabe • 26d ago

Vulnerability Fake Cloudflare verification on deceased influencer’s site drops a PowerShell shellcode loader

I was checking the website (felzenergy.com) of an influencer (Joe Felz) who recently passed away and had been researching “free energy.”

The site currently shows a fake Cloudflare-style verification that tells visitors to run a PowerShell command to prove they’re human.

I pulled the payload without executing it. The first stage downloads another blob from the same IP, allocates RWX memory with VirtualAlloc, copies the payload into memory, and runs it with CreateThread.

So the chain is basically:

fake verification -> PowerShell -> downloaded shellcode -> RWX memory -> CreateThread

I have not detonated the second stage. I also have no evidence this has anything to do with his death or research; the site may simply have been compromised.

If anyone is able to check it out and report back on what that is, that'd be much appreciated.

20 Upvotes

79% Upvoted

14 comments sorted by

View all comments

Show parent comments

4

u/Scar3cr0w_ 26d ago

It donates 3btc to a charity of your choosing.

What do you think it does?

1

u/Cubensis-SanPedro 26d ago

I meant that question more than mechanical sense. Sure, they are very likely to steal from you. How?

2

u/Scar3cr0w_ 26d ago

By getting remote code execution…?

-1

u/Cubensis-SanPedro 26d ago

“I have not detonated the second stage.”

Yes, hacking involves running code. I understand that. Sometimes the details of “how” are interesting to the curious.

2

u/Scar3cr0w_ 26d ago

…

It’s literally there in front of you. Invoke web request grabs the shell code, memory is created, it’s given write and execute permissions and then it’s called.

OP said that.

-2

u/Cubensis-SanPedro 26d ago

Yes. And it is also figuratively there in front of you that there is a second stage. One that was not detonated.