Update: I saw this when viewing a blog built with the Ghost framework. Looks like it was a legitimate exploit that has since been patched, at least on the blog I was looking at. Stay safe out there folks!
https://www.malwarebytes.com/blog/bugs/2026/05/700-education-and-tech-websites-hijacked-in-huge-clickfix-malware-campaign
https://www.reddit.com/r/cybersecurity_help/comments/1iy227k/accidentally_ran_powershell_code_from_captcha/
satsie / satsie 🇹🇭 🇱🇹
npub1fh…3nzcu
2026-06-22 02:05:52 UTC
in reply to nevent1q…xt0s
Author Public Key
npub1fhmmgwe6fk6tn83ahttt6ruyyfnjdm7k8tn7qflert9ajx6dhfyqf3nzcuSeen on
wss://nos.lolPublished at
2026-06-22 02:05:52 UTCEvent JSON
{
"id": "ba8f2ab54934f3fa4286396335d8ea63353a90979973a5c1af0722b7bf929495",
"pubkey": "4df7b43b3a4db4b99e3dbad6bd0f84226726efd63ae7e027f91acbd91b4dba48",
"created_at": 1782093952,
"kind": 1,
"tags": [
[
"e",
"2ac8a6ee24d96041adfad1e9b58011a5082bd390580d4b3e8e85c877a6eb056c",
"",
"root"
],
[
"p",
"4df7b43b3a4db4b99e3dbad6bd0f84226726efd63ae7e027f91acbd91b4dba48"
],
[
"r",
"wss://relay.damus.io/"
],
[
"r",
"wss://nostr-pub.wellorder.net/"
],
[
"r",
"wss://nos.lol/"
],
[
"r",
"wss://relay.primal.net/"
],
[
"r",
"wss://pyramid.fiatjaf.com/"
],
[
"r",
"wss://relay.snort.social/"
],
[
"r",
"wss://nostr.mom/"
],
[
"r",
"wss://nostr.oxtr.dev/"
],
[
"client",
"Primal Web"
]
],
"content": "Update: I saw this when viewing a blog built with the Ghost framework. Looks like it was a legitimate exploit that has since been patched, at least on the blog I was looking at. Stay safe out there folks!\n\nhttps://www.malwarebytes.com/blog/bugs/2026/05/700-education-and-tech-websites-hijacked-in-huge-clickfix-malware-campaign\n\nhttps://www.reddit.com/r/cybersecurity_help/comments/1iy227k/accidentally_ran_powershell_code_from_captcha/",
"sig": "790c320178fc57815c9e047d139d864c7aedd74a3bf6455805008d2e2655ab324b973cd2ef4626178beeb10039291b1e8477b81621a5f7fb3c0d561cc3606a56"
}