I was checking the website (felzenergy.com) of an influencer (Joe Felz) who recently passed away and had been researching “free energy.”

The site currently shows a fake Cloudflare-style verification that tells visitors to run a PowerShell command to prove they’re human.

I pulled the payload without executing it. The first stage downloads another blob from the same IP, allocates RWX memory with VirtualAlloc, copies the payload into memory, and runs it with CreateThread.

So the chain is basically:

fake verification -> PowerShell -> downloaded shellcode -> RWX memory -> CreateThread

I have not detonated the second stage. I also have no evidence this has anything to do with his death or research; the site may simply have been compromised.

If anyone is able to check it out and report back on what that is, that'd be much appreciated.