ClickFix Malware Campaign Spoofs Cloudflare Verification
The campaign targets Windows and macOS systems by tricking users into executing malicious code through fake security pages.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you trust your ability to identify fake website verification pages when browsing the internet?
A researcher has identified a new ClickFix malware campaign utilizing fraudulent Cloudflare verification pages to target both Windows and macOS users. The campaign relies on deceptive JavaScript instructions that attempt to trick users into running malicious commands on their local systems.
Why it matters
This campaign highlights the persistent risk of social engineering attacks that masquerade as legitimate security verification protocols to bypass system defenses. It underscores the ongoing challenge of defending against browser-based scripts designed to manipulate user behavior.
The campaign uses the domain js-static[.]cfd to host tracking and API endpoints. Observed interactions returned a 403 HTTP status code when attempting to execute commands on Windows, suggesting a potential failure in the attacker's staging environment.
The details
The ClickFix mechanism operates by presenting a fake verification page to users through a JavaScript file. This file prompts the user to manually execute specific commands, a technique designed to bypass automated security measures. The infrastructure pivots through various tracking endpoints, including domains identified as cf-id[.]com for macOS targets and api-com[.]cfd for Windows systems.
Timeline
- 2026-10-28
Researcher observed the initial ClickFix campaign activity.
The Tech Race
This campaign mimics legitimate security challenges to trick users into executing malicious code. It remains a persistent challenge for security teams as attackers continue to iterate on social engineering techniques that bypass traditional automated scanning.
Users may encounter fake browser verification prompts that ask them to run commands or scripts to prove they are human. If you see unexpected instructions to copy and run code from a webpage, avoid interacting with the prompt as it is likely a malicious attempt to infect your device.
The takeaway
The campaign serves as a reminder to verify the origin of any security prompt asking for command-line execution or administrative access. Watch for further reports on whether the attackers resolve the infrastructure failures observed in the macOS and Windows components of this campaign.
Further reading
For more on evolving threat vectors and browser-based exploits, visit the Cybersecurity section.
Source note: This article includes information reported by SANS Internet Storm Center.
Live Poll
Do you trust your ability to identify fake website verification pages when browsing the internet?
