Almost got hacked while downloading PDF… seriously?

All I wanted to do was get my hands on The Hacker Playbook to better my game. Of course, searching took forever, and after going through endless links, I finally came across a site which looked like a legitimate source.

Well, boy was I wrong!

I downloaded from their link and instead of the actual PDF, they threw at me a “Are you really not a robot?” captcha. Nothing new in there and after checking the “I’m not a robot” checkbox, things turned bizarre. A window came up requesting that I enter some PowerShell command into my terminal in order to verify my “humanity.”

Of course, as any seasoned security student i will tell you, if a website asks for running something inside a terminal, there should be a red flag. Instead of doing so, out of curiosity, I checked the code.

The code, while being a total mess, showed me quite clearly what these guys were trying to do Then I reported this thing to the Hosting provider namecheap I sent this email to them:

To: abuse@namecheap.com

Dear Namecheap Abuse Team,

I am writing to report a domain registered with your service that is being used to distribute malware.

Domain: quickloadbinpack.click Malicious URL: [https://js5c.quickloadbinpack.click/?e7e0032d72badb757923052c858](https://js5c.quickloadbinpack.click/?e7e0032d72badb757923052c858)

Incident Description: The website employs a fake CAPTCHA to deceive users into executing a PowerShell script. My analysis shows this script uses XOR obfuscation to hide its true intent. Once run, it silently executes a command to download and run an unauthorized executable file from adtraffic.monster in a hidden process.

I attempted to provide the source script for your verification, but it was blocked by my email provider’s security filters. However, the details above provide the necessary indicators for your team to identify and verify the malicious activity on this domain.

I request that you investigate this domain and take appropriate action to prevent further abuse.

Sincerely,

meheraz hossen siyam

Then I got a automated Response from the team to confirm that my email is successfully received by their team I received an automated email like that:

Hello,meheraz hossen siyam

Thank you for contacting the Namecheap Legal and Abuse department. We confirm receipt of your report. It will be reviewed and processed following our policies.

Please note that Namecheap investigates a large volume of complaints; therefore, we will respond to you only if additional information on the matter is required. However, rest assured that your complaint will be properly evaluated, and action will be taken if necessary.

You are welcome to check whether the domain is active by searching its status via a public lookup tool (e.g., https://lookup.icann.org/en). If the domain status is clientHold/serverHold, it means the domain has been suspended and is not available on the internet.

If you wish to contact the domain holder or hosting/email provider for the domain name in question, you may consider using the RrSG ACID Tool (https://acidtool.com/) to identify their contact details.

IMPORTANT: In order to properly and efficiently investigate your submission, it is very important that you follow the guidelines we’ve provided on how to submit your type of complaint and what to include.

To help us thoroughly investigate your claim, please ensure your submission includes all the requirements we describe. If you have submitted a complaint and realize that information is missing, please simply reply to this message, including the additional information, and make sure that the engagement ID is kept in the subject so that we can track your replies. Please ensure you have reviewed them and followed our instructions.

For additional information, below you will find links to instructions depending on the type of abuse you are reporting.

Information required to support our investigation: https://www.namecheap.com/support/knowledgebase/article.aspx/9196/5/how-and-where-can-i-file-abuse-complaints

How does Namecheap investigate Suspected Email Abuse/Spam? https://www.namecheap.com/support/knowledgebase/article.aspx/10184/5/how-does-namecheap-investigate-suspected-email-abusespam

Copyright and Trademark Policies: https://www.namecheap.com/legal/general/copyright-trademark-policies/

Take It Down Act Policy: https://www.namecheap.com/legal/general/notice-and-removal-of-non-consensual-intimate-visual-depictions/

Uniform Domain-Name Dispute-Resolution Policy (UDRP): https://www.namecheap.com/legal/domains/udrp/

Uniform Rapid Suspension System (URS): https://www.icann.org/urs-en/

Namecheap Court Order & Subpoena Policy (including customer personal information disclosure requests): https://www.namecheap.com/legal/general/court-order-and-subpoena-policy/

In order to learn how to notice different types of incidents, how to report them, and some of the best remedial actions and preventive measures that can be taken, you are welcome to check the following article: https://www.namecheap.com/guru-guides/understanding-fraud-and-abuse-dp/

If you represent a cybersecurity entity and submit phishing/fraud reports on a regular basis, it is advised to consider using the Namecheap API to optimize and speed up the flow of submitting/processing abuse complaints. In order to proceed with setting up an API reporting system with Namecheap, please contact us via abuseescalation@namecheap.com for details.

Additionally, let us emphasize that all requests and/or notices from India related to and/or from the following: Legal Notices (including but not limited to Advance Notices and Court Orders (of any kind)) or Orders/Request for Action or Information from national agencies (NIXI, CERT, MeitY, etc) and/or law enforcement MUST be submitted to Namecheap’s Grievance Officer. You are welcome to send your request to the grievanceofficer@namecheap.com email address. For more information, please refer to the following article: https://www.namecheap.com/support/knowledgebase/article.aspx/10586/5/reporting-grievances-from-india/

If you are seeking to submit a complaint under the EU’s Digital Services Act (DSA), according to the DSA requirements, you must submit the complaint using our established DSA report channels. These channels are listed in Paragraph 9 of our Universal Terms of Service: https://www.namecheap.com/legal/universal/universal-tos/

Kind regards, Legal & Abuse Department Namecheap.com

So as they described in this automated reply that they don't give reply after the action So After waiting for sometimes I have saw that the website is no longer loading The website is only showing the white screen but I have seen one thing that The attack have two ways to treak the people When I visited this link https://js5c.quickloadbinpack.click/?e7e0032d72badb757923052c858 I have saw that the website a separate window for treaking user as the secondary plan of of the attackers I saw a page like that:

Then I sent a reply to the email from Namecheap I have Send this reply to them

to: Namecheap

Dear Abuse Team,

I am writing to express my sincere appreciation for your assistance in addressing the malicious activity associated with the domain quickloadbinpack.click

I noticed that the site is now returning a “522 Connection Timed Out” error, which indicates that the threat has been successfully mitigated. Thank you for taking the time to review the evidence I provided, including the escalation regarding the subdomains. Your team’s action has made the internet a safer place for other users.

I will continue to monitor the landscape for similar threats and will not hesitate to report them if I encounter them in the future. Thank you again for your diligence and professional support.

Best regards,

Meheraz Hossen siyam

After this I was checking the site for the action what they need actually with the site Then one day when I visited this site I saw this

days after I sent my second report I checked the site one last time. Of a 403 error my browser said it had a Cloudflare 522 Connection Timed Out error.

That means I have completed my mission Successfully as a security learner and Researcher

What I have learned from this:

1. As a learner and researcher I saw that how people fall In this kind of trap
2. Don't believe anything without checking twice
3. Don't chase for free thing Because in the world nothing is free if you are saying that this thing is free in online so you are paying the price with your data

So for avoiding this kind of I think you should not copy random things and download random things from online because they can contain malware harmful things