Fake Cloudflare checks on hacked sites push ClickFix commands
Original title: Hackers Turn Compromised Websites Into Fake Cloudflare Verification Traps for Windows and Mac Users
SANS could not retrieve the Windows or macOS payload after test fetches returned HTTP 403 or failed to resolve.
Attackers are using compromised websites to show fake Cloudflare verification pages that instruct Windows and macOS visitors to run commands outside the browser. SANS Internet Storm Center researcher Duncan documented the previously unnamed ClickFix activity on October 28, 2026, and saw different instructions by operating system. Test execution hit an HTTP 403, and a domain failed to resolve, so no payload was recovered. The compromised site was not named, and the report does not tie this activity to earlier ClickFix malware operations.
Unconfirmed: The final malware, persistence, operator and number of compromised sites are unresolved because no payload was recovered.
- Published indicators use the defanged host js-static.cfd, including embed.js and tracking URLs.
- Microsoft describes ClickFix as a fake problem that leads victims to run supplied commands.
- Windows lures commonly use the Run dialog; macOS variants point users to Terminal.
- A real CAPTCHA should not ask users to paste commands into Run, PowerShell or Terminal.
Impact: Users may execute attacker-supplied commands on Windows or macOS
- 1.Treat verification pages that request Run, PowerShell or Terminal commands as malicious.
- 2.Hunt for js-static.cfd script and tracking URLs in browser and proxy logs.
- 3.Check whether users who saw the lure then ran commands or made outbound connections.
- Vendors
- Cloudflare
- Organizations
- SANS Internet Storm CenterMicrosoft
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | js-static.cfd | d endpoint remained uncompromised. IOCs No. URL 1 hxxps[:]//js-static[.]cfd/embed.js?v=24 2 hxxps[:]//js-static[.]cfd/api/s/on?site=[ |
| url | https://js-static.cfd/api/s/hit | //js-static[.]cfd/api/s/on?site=[information removed].com 3 hxxps[:]//js-static[.]cfd/api/s/hit 4 hxxps[:]//js-static[.]cfd/api/s/hit 5 hxxps[:]//js-st |
| url | https://js-static.cfd/api/s/on?site=[information | d. IOCs No. URL 1 hxxps[:]//js-static[.]cfd/embed.js?v=24 2 hxxps[:]//js-static[.]cfd/api/s/on?site=[information removed].com 3 hxxps[:]//js-static[.]cfd/api/s/hit 4 hx |
| url | https://js-static.cfd/api/track/event | tic[.]cfd/api/s/hit 4 hxxps[:]//js-static[.]cfd/api/s/hit 5 hxxps[:]//js-static[.]cfd/api/track/event Note: IP addresses and domains are intentionally defang |
| url | https://js-static.cfd/embed.js?v=24 | ry affected endpoint remained uncompromised. IOCs No. URL 1 hxxps[:]//js-static[.]cfd/embed.js?v=24 2 hxxps[:]//js-static[.]cfd/api/s/on?site=[information |
From the original article
3 min read at gbhackers.com
Attackers are using compromised websites to present fake Cloudflare verification pages that steer Windows and macOS users toward executing malicious commands. The findings establish a delivery attempt, not a confirmed infection or identified malware family. The activity exploits the familiarity of browser security checks.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.