Fake Cloudflare checks push ClickFix commands to Windows and Mac users
Original title: Hackers Use Fake Cloudflare Verification Pages to Target Windows and Mac Users
Commands pointed to api-com.cfd and cf-id.com, but neither yielded a payload, so the malware remains unknown.
A ClickFix campaign observed on October 28, 2026, overlays fake Cloudflare “Verify you are human” pages on compromised legitimate websites. A script from js-static.cfd shows different instructions for Windows and macOS and asks visitors to run a command. SANS Internet Storm Center handler Brad Duncan could not retrieve either payload: the Windows URL returned 403 Forbidden and the Mac domain did not resolve. He says URLscan hits suggest more than one compromised site.
Unconfirmed: The final malware for both operating systems is unknown because the command URLs failed.
- The first script is embed.js on js-static.cfd and calls time-zone, location and IP endpoints.
- Windows instructions pointed to api-com.cfd; macOS instructions pointed to cf-id.com.
- Duncan had not seen this specific activity before and has not named it.
- CERT-UA separately reported more than 100 hacked sites pushing LUNEXSTEALER checks.
- A genuine Cloudflare check does not ask users to open Run, PowerShell or Terminal.
Impact: Users are tricked into running attacker commands themselves
- 1.Close any page that asks you to paste a command into Run, PowerShell or Terminal.
- 2.Block js-static.cfd, api-com.cfd and cf-id.com.
- 3.Website owners should check pages for unknown scripts such as embed.js.
- Malware
- LUNEXSTEALER
- Organizations
- SANS Internet Storm CenterCERT-UA
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | api-com.cfd | tors saw different commands. The Windows command pointed to api-com[.]cfd, and the Mac command pointed to cf-id[.]com. Duncan could |
| domain | cf-id.com | nd pointed to api-com[.]cfd, and the Mac command pointed to cf-id[.]com. Duncan could not follow either one to the end. When he r |
| domain | js-static.cfd | on the compromised website. A script loaded from the domain js-static[.]cfd runs in the visitor’s browser. Duncan saw the script call |
| url | https://api-com.cfd/7ge0w58tzzjsv9 | OS ClickFix command URL (did not resolve on 2026-10-28) URL hxxps[:]//api-com[.]cfd/7ge0w58tzzjsv9 Windows ClickFix command URL (returned 403 Forbidden on |
| url | https://cf-id.com/?ray-id=nz0ovm2jq2g68i | c[.]cfd/static/fonts/jetbrains-mono-600.woff2 Font file URL hxxps[:]//cf-id[.]com/?ray-id=nz0ovm2jq2g68i macOS ClickFix command URL (did not resolve on 2026-10- |
| url | https://js-static.cfd/api/s/boot | n check URL hxxps[:]//js-static[.]cfd/api/s/ip IP check URL hxxps[:]//js-static[.]cfd/api/s/boot Boot call URL hxxps[:]//js-static[.]cfd/api/s/wait Wait |
| url | https://js-static.cfd/api/s/geo | URL hxxps[:]//js-static[.]cfd/api/s/tz Time zone check URL hxxps[:]//js-static[.]cfd/api/s/geo Location check URL hxxps[:]//js-static[.]cfd/api/s/ip I |
| url | https://js-static.cfd/api/s/hit | fd/api/s/on Tracking call (site name removed in source) URL hxxps[:]//js-static[.]cfd/api/s/hit Repeated tracking call URL hxxps[:]//js-static[.]cfd/ap |
| url | https://js-static.cfd/api/s/ip | URL hxxps[:]//js-static[.]cfd/api/s/geo Location check URL hxxps[:]//js-static[.]cfd/api/s/ip IP check URL hxxps[:]//js-static[.]cfd/api/s/boot Boot |
| url | https://js-static.cfd/api/s/on | js-static[.]cfd/embed.js?v=24 First script in the chain URL hxxps[:]//js-static[.]cfd/api/s/on Tracking call (site name removed in source) URL hxxps[: |
| url | https://js-static.cfd/api/s/st | call URL hxxps[:]//js-static[.]cfd/api/s/wait Wait call URL hxxps[:]//js-static[.]cfd/api/s/st Status call URL hxxps[:]//js-static[.]cfd/embed?site=[r |
| url | https://js-static.cfd/api/s/tz | :]//js-static[.]cfd/api/track/event Event tracking call URL hxxps[:]//js-static[.]cfd/api/s/tz Time zone check URL hxxps[:]//js-static[.]cfd/api/s/geo |
| url | https://js-static.cfd/api/s/wait | heck URL hxxps[:]//js-static[.]cfd/api/s/boot Boot call URL hxxps[:]//js-static[.]cfd/api/s/wait Wait call URL hxxps[:]//js-static[.]cfd/api/s/st Status |
| url | https://js-static.cfd/api/track/event | ps[:]//js-static[.]cfd/api/s/hit Repeated tracking call URL hxxps[:]//js-static[.]cfd/api/track/event Event tracking call URL hxxps[:]//js-static[.]cfd/api/s |
| url | https://js-static.cfd/c.js?embed= | s-static[.]cfd/embed?site=[removed] Loads the fake page URL hxxps[:]//js-static[.]cfd/c.js?embed= _JNJ_4 _ Second script URL hxxps[:]//js-static[.]cfd/st |
| url | https://js-static.cfd/embed.js?v=24 | ts the script and assets for the fake verification page URL hxxps[:]//js-static[.]cfd/embed.js?v=24 First script in the chain URL hxxps[:]//js-static[.]cfd |
| url | https://js-static.cfd/embed?site=[removed | call URL hxxps[:]//js-static[.]cfd/api/s/st Status call URL hxxps[:]//js-static[.]cfd/embed?site=[removed] Loads the fake page URL hxxps[:]//js-static[.]cfd/c.js |
| url | https://js-static.cfd/static/cf_dark_horizontal.png | atic[.]cfd/static/CF-Logo%201.png Cloudflare logo image URL hxxps[:]//js-static[.]cfd/static/cf_dark_horizontal.png Cloudflare logo image URL hxxps[:]//js-static[.]cfd/sta |
| url | https://js-static.cfd/static/CF-Logo%201.png | [:]//js-static[.]cfd/c.js?embed= _JNJ_4 _ Second script URL hxxps[:]//js-static[.]cfd/static/CF-Logo%201.png Cloudflare logo image URL hxxps[:]//js-static[.]cfd/sta |
| url | https://js-static.cfd/static/fonts/jetbrains-mono-600.woff2 | cfd/static/cf_dark_horizontal.png Cloudflare logo image URL hxxps[:]//js-static[.]cfd/static/fonts/jetbrains-mono-600.woff2 Font file URL hxxps[:]//cf-id[.]com/?ray-id=nz0ovm2jq2g |
From the original article
4 min read at cybersecuritynews.com
A new ClickFix campaign is using fake Cloudflare verification pages to trick both Windows and Mac users into running harmful commands on their own computers. The pages look like the “Verify you are human” checks that many people click through every day. Instead of a quick security check, the visitor ends up starting an infection […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.