{\blur10\fad(200,200)}翻译/压制/字幕制作：HAF半个水果
{\blur10\fad(200,200)\pos(1951.704,1855.407)}使用AI工具翻译，如有不准确的地方请在弹幕或评论区指正，谢谢！\N
！！真的有人看不到这行字！！
{\blur10\fad(200,200)\pos(1956.149,1882.519)}翻译质量权威评价：原来25年就有小拉即用机翻糊弄人了
In this video I will present to you... another fake captcha.
know I've made like 5 videos on this topic in the past week
{\fad(200,200)\pos(1922.667,324.666)}该视频在2025年8月8日录制
I really like fake captchas.
这类视频的播放量实在惨不忍睹 各位似乎也看得厌烦了
The views on these videos are absolutely horrible and you guys seem to be bored by them.
I have a visionary mindset.
Fake captchas will cease to exist very soon.
once-in-a-lifetime opportunity for us to gather up together
enjoy the absolute abundance of fake captchas
and document all of them before they're gone.
But where are you going to turn to
once all of this beautiful stuff is gone?
I truly believe way back in the day people were super annoyed and bored by the fake anti-malware.
It was out there in every corner of the internet.
但看看现在 谁不期盼着能有新型虚假反恶意软件问世？
This is how malware always has been
it's just another page of the book.
This will be the last fake captcha video I ever make.
But I want you to visit this video 5 years from now
It is the most clever and crafty malware out there so far.
The evolution from fake anti-malware
it's honestly beautiful to witness.
So if you're watching in 2030 and beyond
请务必在评论区告诉我 当初保留这些验证码的决定是否正确
please tell me in the comments if I made the right call to preserve all these captchas
which are right now considered boring and mainstream.
Of course if I'm still out there alive and well.
which fetches your IP address
looks exactly like the original and adapts to the platform.
In the background I have an anti-detect dashboard running.
It's a tool to create instances of browsers with fake fingerprints.
Using that tool I'll show you how the site adapts its malicious shellcode to infect the recipient.
So I'm going to create Windows
Linux and macOS browsers.
So let's go ahead and start real quick.
你可以选择操作系统 完全修改浏览器指纹及硬件识别方式
So you can select the OS and you can completely modify your browser fingerprint and how it detects your hardware.
This dashboard contains plenty of upsells
So here is our Windows 11 browser.
You can change everything so the websites don't detect us
but that's pretty much enough for the fake captcha.
These tools are usually used for circumventing Facebook detection or Google detection
variables they have to account for.
So we create that anyway.
We have a Linux browser right here.
We have three browsers and we can start them concurrently.
Let's go ahead and do that.
It's basically Google Chrome
except it's running on different platforms.
It's emulating different platforms.
我们要在这三个浏览器里打开假验证码网站 看看会发生什么
We're gonna enter the fake captcha website on these three browsers and see what happens.
We have macOS on the left
So let's go ahead and run that captcha at the same time on every browser.
We're gonna paste the URL in every address bar
We have three captchas running in different browsers on different platforms.
I'm gonna zoom in real quick.
So this is how this page looks.
This network is blocked due to unaddressed abuse complaints about malicious behavior.
“本页面正在验证请求是否来自真人而非该网络的机器人程序”
This page checks to see if it's really a human sending the request and not a robot coming from this network.
It exposes your IP address.
I've never seen that before in a fake captcha and got a timestamp which is valid and actual
Then the URL we're supposedly trying to access
which I can probably access from macOS.
It doesn't really matter.
As long as you press on the captcha
you get shellcode to execute.
So let me just bring up the notepad real quick.
We're gonna paste every command we get into here.
So let's start from macOS.
Please follow the instructions below.
Press command plus space to open spotlight.
Type terminal and press return.
So they give you an option to copy that
but you can also press the button
which is obviously the easiest way and what most people will do.
So they're asking you to open terminal on macOS.
Let's see what the command is.
And the command is quite obviously not g drive verify.
It's actually a base64 command.
They're echoing into your terminal and piping into bash.
This is the equivalent in normal encoding.
download this file right here
And that's how it starts.
So you're actually downloading an executable into your Mac and running it.
except it's different for every platform.
That's what it shows us for macOS.
Let's hop onto Linux and see what happens.
What does it give us now?
I'm not sure there is such a command on Linux.
Security validation pending.
Is there an IWR command on Linux?
{\fad(200,200)\pos(2744,1922)}它在任何 Linux 发行版上都无法运行
It downloads something from wetnova.best.
That's the Linux side of things.
Let's see what Windows has to offer.
Press the Windows key plus X.
So Windows plus X gives you a little power menu right here on the bottom left.
And press I to open terminal.
You can see the I being underlined.
it's opening the terminal.
Press control V and press enter to verify
which we're not going to do.
Let's see what the command is.
That is the command for Windows.
So the idea is basically the same.
They give us a little comment at the end
so we don't feel suspicious.
然后我们收到“调用网络请求 wetnova.best/collapse.png”的指令
And then we get invoke web request wetnova.best collapse.png and then pipes it to IEX
which is important for PowerShell
because if you invoke the web request
You have to execute that as well.
So that's what the IEX command does.
It executes the stuff you download.
现在让我们看看wetnova.best网站暗藏什么玄机
So let's see what wetnova.best has to offer.
我们将在Linux浏览器中运行wetnova.best网站
We're going to run wetnova.best on the Linux browser.
It's probably been removed already
unless we can try that with curl.
So we're going to open this in notepad++ now.
We don't get to see what it has to offer.
不过让我们看看collapse.png文件里藏着什么
But let's see what collapse.png has in store for us.
We're going to run this on the Windows browser.
but we're trying to stay authentic.
Because it's actually not a PNG file.
It's a PowerShell script.
If we download this PNG file and rename it to txt
we can actually see what it does.
So let's do that real quick.
This is the collapse.png inside.
It's an obfuscated script with a couple functions.
It seems to be really juicy inside.
I can't really read that so far
but I can see... is this a ransomware?
AES managed cipher mode cryptography.
How much you want to bet it's a ransomware?
It's definitely hard to tell what's going on here because everything is so obfuscated.
But I can see the imports.
The imports actually have to be readable.
What's up with cryptography
This must be executable code.
I think they just obfuscated it and they're then concatenating everything together.
他们在这里解码的其实是一个二进制文件然后把它编译成可执行程序
What they're decoding here is basically a binary file that it's then compiling into an exe.
but you know what I mean.
它正在拼接那个字符串然后把所有内容组合起来生成可执行文件
It's concatenating that string and then adding everything together to make an executable file.
So the executable file is in here because the length of it is two megabytes
And the ratio of base64 is
This is what you're running being on Mac OS.
It's being piped to bash.
是啊 估计短时间内是看不到那个IP地址有任何动静了
So apparently that does not work.
But the idea still stands.
There is a captcha for every platform and you can't get away from it.
There is a separate command for every platform that will get you baited.
{\blur10\fad(200,200)\pos(1920.741,425.185)}原标题：No One is Safe Triple ClickFix (MacOS Linux Windows) 原作者：Enderman\N
原视频上传日期：2025年10月12日
This is the last video on fake captchas that I will make.
And be careful out there.
Never fall victim to this type of scam and take care.
{\blur90\fad(200,200)\fscx185\fscy188\pos(1872,789.333)}在 Youtube 上关注
{\blur10\fad(200,200)\pos(1909.333,1220)}翻译/压制/字幕制作：HAF半个水果\N
翻译质量权威评价：原来25年就有小拉即用机翻糊弄人了
{\blur10\fad(200,200)\pos(1889.334,1336)}如果你喜欢这个视频，请多多支持和评论哒~ o((>ω< ))o\N
字幕制作不易，喜欢的话支持一下我吧！