Observed arrival · 2026-11-01
git-google.com’s obfuscated PowerShell payload
Credibility concern recorded. The source reference remains available for verification and correction.
The homepage displays an obfuscated PowerShell script with embedded Python bootstrap and download code.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Security researchers examining suspicious scripts
- Worth noticing
- The embedded Python code references both a same-domain URL and Python 3.12 embedded-runtime archives hosted at python.org.
Field notes
The visible script assembles some strings at runtime and decodes other values from base64, making the displayed source less direct to read. Its embedded Python includes routines for downloading data and extracting a UUID-like value, but the supplied excerpt ends before the full workflow is shown. The references to a same-domain path and Python 3.12.7 embedded archives are visible in the code.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
◎NicheUnusually specific use
⚑RiskCredibility concern recorded
One card from the complete issue