Berlin Senate employee executed a command that a website politely asked him to execute.

Reply to Berlin Senate employee executed a command that a website politely asked him to execute. on Thu, 10 Sep 2026 10:15:06 GMT

jernej__s@infosec.exchange — Thu, 10 Sep 2026 10:15:06 GMT

@dandels @LukaszOlejnik My workaround is to disable Win+R (which has an unfortunate side-effect of not allowing you to type a folder name to Explorer's address bar) and to remove PowerShell/Terminal/Command Prompt links from Win+X menu.

Reply to Berlin Senate employee executed a command that a website politely asked him to execute. on Thu, 10 Sep 2026 09:09:43 GMT

schrotthaufen@mastodon.social — Thu, 10 Sep 2026 09:09:43 GMT

@dandels @LukaszOlejnik At least one can stop some things by enforcing constrained language mode. Not sure it would have helped with that payload, though.

Reply to Berlin Senate employee executed a command that a website politely asked him to execute. on Thu, 10 Sep 2026 08:59:19 GMT

richrockster@mastodon.social — Thu, 10 Sep 2026 08:59:19 GMT

@troed @LukaszOlejnik there’s a term for the growing blasé attitude that develops from having to do this constantly however - “approval fatigue”. This leads to ‘rubber stamping’ where a user will just do the task of clicking or in this case Ctrl-C/Ctrl-V and not expect anything to happen.
macOS is borderline insane with this now: an example is you have to approve an app to read a directory, and it’s per-directory. Secure perhaps but my goodness it’s bloody annoying and exhausting.

Reply to Berlin Senate employee executed a command that a website politely asked him to execute. on Thu, 10 Sep 2026 08:36:33 GMT

dandels@infosec.exchange — Thu, 10 Sep 2026 08:36:33 GMT

@LukaszOlejnik Not something that anyone has ever paid me to configure, but I suspect that disabling PowerShell for regular AD users is really not made to be the easy default that it likely should be.

Reply to Berlin Senate employee executed a command that a website politely asked him to execute. on Thu, 10 Sep 2026 08:36:00 GMT

troed@swecyb.com — Thu, 10 Sep 2026 08:36:00 GMT

@LukaszOlejnik Teaching people that it's normal to have to click on unintended things to be able to see the intended thing wasn't very smart.

*) cookie popup
*) are you human popup
*) this website isn't secure popup

Reply to Berlin Senate employee executed a command that a website politely asked him to execute. on Thu, 10 Sep 2026 08:35:09 GMT

gytisrepecka@social.gyt.is — Thu, 10 Sep 2026 08:35:09 GMT

@LukaszOlejnik I understand not every computer user figures out what terminal is. But it's organization's fault they:

Allow regular users to access terminal;
Has no rate limiting and observability whatsoever to allow this large exfiltration to happen.

Gross mismanagement