pull down to refresh
unsuspecting users are tricked into copying and executing a PowerShell command from an infected website