Fake Cloudflare Checks Trick Windows and Mac Users Into Running Malware Commands

A ClickFix campaign first observed on 28 October 2026 is turning one of the web's most familiar rituals, the Cloudflare "Verify you are human" box, into an infection vector. Visitors to compromised but otherwise legitimate websites are shown a convincing imitation of the check and then told to "complete verification" by pasting a command into the Windows Run dialog or the macOS Terminal. No software flaw is exploited and nothing is downloaded by the browser. The victim performs the dangerous step personally.

What happened

The chain starts with a small script injected into a hacked site and served from the attacker-controlled domain js-static[.]cfd. Once it runs in the browser, it draws a full-page overlay with a Cloudflare logo and matching web fonts, and fires a series of calls back to the same domain that check the visitor's time zone, location and IP address. That fingerprinting most likely helps the operators decide who gets the lure and which version of it, although that part has not been confirmed.

The overlay then claims that "verification is taking longer than usual" and lists three steps: hold Win+R, press Ctrl+V, press Enter. The page has already placed a command in the clipboard. On Windows it calls the Microsoft installer utility under a lightly disguised name to fetch and silently install a package from api-com[.]cfd; a long decoy string is appended so that the only text visible in the Run box reads "To verify push the ENTER key". Mac visitors receive a different recipe: a one-liner that pulls a script from cf-id[.]com and pipes it straight into bash. Each operating system gets its own instructions, so the same lure works on both.

Neither payload could be retrieved during analysis. The Windows URL answered with a 403 Forbidden and the macOS domain did not resolve, so the final malware for either platform is still unknown. The injected script does, however, show up on several other websites, which points to a multi-site campaign rather than a single compromised host.

Why it matters

ClickFix keeps working because it borrows trust instead of breaking software. Almost everyone has clicked through a Cloudflare check. The only unusual element is a request to paste something, and on a site the visitor already knows, that request often goes unquestioned. Because the command is run by the user through a legitimate system binary, many endpoint controls see nothing more than routine activity.

The technique is spreading. A separate recent wave used the same fake-Cloudflare lure on more than a hundred hacked sites to push an information stealer at Windows visitors, and macOS users are now targeted often enough that recent versions of macOS warn when suspicious text is pasted into Terminal. This campaign is the next iteration, not an outlier.

What to do

• Teach one rule. A genuine Cloudflare check never asks you to open the Run box, PowerShell or Terminal. If a page does, close the tab.
• Harden endpoints. Disable the Windows Run dialog through Group Policy where users do not need it, and alert on unusual msiexec, mshta, PowerShell or Terminal activity, especially when it follows a browser session.
• Block and hunt. Add the domains below to DNS and proxy blocklists and search logs for past connections to them.
• Check your own website. Review pages for scripts you did not add. The campaign depends entirely on hacked sites, and injected JavaScript is often the first visible symptom of a deeper compromise.

Those hacked sites are the quiet half of this story. Outdated CMS cores, vulnerable plugins and exposed admin panels are how attackers earn the ability to inject scripts in the first place, and that is exactly the class of weakness 4tify's vulnerability scanning is designed to surface before someone else finds it.

Indicators of compromise

Indicators are deliberately defanged. Re-fang them only inside controlled tooling such as your SIEM or threat-intelligence platform.