Phishing & fraudmedium
Unnamed ClickFix campaign uses fake Cloudflare checks on Windows and macOS
Original title: Yet Another ClickFix Campaign, (Wed, Oct 28th)
AI summary · x-ai/grok-4.7Summaries by Vani AI
The researcher could not retrieve either payload: Windows returned 403 and the macOS malware domain did not resolve.
A SANS Internet Storm Center diary documents a previously unseen ClickFix campaign observed on October 28, 2026. A fake Cloudflare verification page on a compromised site instructs Windows and macOS visitors to run commands. The Windows malware host returned 403 Forbidden, and the macOS host domain did not resolve, so neither payload was obtained. The activity is tied to js-static[.]cfd, with payload URLs on cf-id[.]com and api-com[.]cfd.
Unconfirmed: The distributed macOS and Windows malware was not recovered, and the activity is not attributed to a named group.
Key facts
- The campaign has no public name in the diary.
- Fake-page traffic starts at js-static[.]cfd/embed.js.
- The macOS command used hxxps://cf-id[.]com, which did not resolve.
- The Windows command used hxxps://api-com[.]cfd and received 403 Forbidden.
- The compromised legitimate site’s identity was withheld.
Security assessment · AI, from the article
Impact: Users are prompted to run commands that would fetch malware
What to do
- 1.Block js-static[.]cfd, cf-id[.]com, and api-com[.]cfd.
- 2.Treat Cloudflare-style verification pages that ask users to run commands as malicious.
- Organizations
- SANS Internet Storm Center
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | api-com.cfd | (Returned 403 Forbidden response on 2026-10-28): hxxps[:]//api-com[.]cfd/7ge0w58tzzjsv9 Final Words For the diary, I removed infor |
| domain | cf-id.com | acOS host (domain did not resolve on 2026-10-28): hxxps[:]//cf-id[.]com/?ray-id=nz0ovm2jq2g68i URL from the ClickFix text seen on |
| domain | js-static.cfd | t I saw from the domain hosting the fake verification page, js-static[.]cfd : hxxps[:]//js-static[.]cfd/embed.js?v=24 hxxps[:]//js-st |
| url | https://api-com.cfd/7ge0w58tzzjsv9 | ndows host (Returned 403 Forbidden response on 2026-10-28): hxxps[:]//api-com[.]cfd/7ge0w58tzzjsv9 Final Words For the diary, I removed information on the |
| url | https://cf-id.com/?ray-id=nz0ovm2jq2g68i | een on a macOS host (domain did not resolve on 2026-10-28): hxxps[:]//cf-id[.]com/?ray-id=nz0ovm2jq2g68i URL from the ClickFix text seen on a Windows host (Retu |
| url | https://js-static.cfd/api/s/boot | path=%2F& q=& redirect= hxxps[:]//js-static[.]cfd/api/s/geo hxxps[:]//js-static[.]cfd/api/s/boot hxxps[:]//js-static[.]cfd/api/track/event hxxps[:]//js- |
| url | https://js-static.cfd/api/s/geo | mation removed].com& path=%2F& page_path=%2F& q=& redirect= hxxps[:]//js-static[.]cfd/api/s/geo hxxps[:]//js-static[.]cfd/api/s/boot hxxps[:]//js-stati |
| url | https://js-static.cfd/api/s/hit | :]//js-static[.]cfd/api/s/on?site=[information removed].com hxxps[:]//js-static[.]cfd/api/s/hit hxxps[:]//js-static[.]cfd/api/s/hit hxxps[:]//js-static |
| url | https://js-static.cfd/api/s/ip | [.]cfd/api/s/boot hxxps[:]//js-static[.]cfd/api/track/event hxxps[:]//js-static[.]cfd/api/s/ip hxxps[:]//js-static[.]cfd/api/track/event hxxps[:]//js- |
| url | https://js-static.cfd/api/s/on?site=[information | , js-static[.]cfd : hxxps[:]//js-static[.]cfd/embed.js?v=24 hxxps[:]//js-static[.]cfd/api/s/on?site=[information removed].com hxxps[:]//js-static[.]cfd/api/s/hit hxxps[ |
| url | https://js-static.cfd/api/s/st | [.]cfd/api/track/event hxxps[:]//js-static[.]cfd/api/s/wait hxxps[:]//js-static[.]cfd/api/s/st hxxps[:]//js-static[.]cfd/api/s/hit hxxps[:]//js-static |
| url | https://js-static.cfd/api/s/tz | c[.]cfd/api/s/hit hxxps[:]//js-static[.]cfd/api/track/event hxxps[:]//js-static[.]cfd/api/s/tz hxxps[:]//js-static[.]cfd/api/track/event hxxps[:]//js- |
| url | https://js-static.cfd/api/s/wait | ic[.]cfd/api/s/ip hxxps[:]//js-static[.]cfd/api/track/event hxxps[:]//js-static[.]cfd/api/s/wait hxxps[:]//js-static[.]cfd/api/s/st hxxps[:]//js-static[ |
| url | https://js-static.cfd/api/track/event | -static[.]cfd/api/s/hit hxxps[:]//js-static[.]cfd/api/s/hit hxxps[:]//js-static[.]cfd/api/track/event hxxps[:]//js-static[.]cfd/api/s/tz hxxps[:]//js-static[ |
| url | https://js-static.cfd/c.js?embed=__JNJ_4__& | ff2 hxxps[:]//js-static[.]cfd/static/cf_dark_horizontal.png hxxps[:]//js-static[.]cfd/c.js?embed=__JNJ_4__& lp=%2F& pu=https%3A%2F%2F[information removed].com%2F& |
| url | https://js-static.cfd/embed.js?v=24 | omain hosting the fake verification page, js-static[.]cfd : hxxps[:]//js-static[.]cfd/embed.js?v=24 hxxps[:]//js-static[.]cfd/api/s/on?site=[information re |
| url | https://js-static.cfd/embed?site=[information | ic[.]cfd/api/s/tz hxxps[:]//js-static[.]cfd/api/track/event hxxps[:]//js-static[.]cfd/embed?site=[information removed].com& parent=https%3A%2F%2F[information removed |
| url | https://js-static.cfd/static/cf_dark_horizontal.png | s[:]//js-static[.]cfd/static/fonts/jetbrains-mono-600.woff2 hxxps[:]//js-static[.]cfd/static/cf_dark_horizontal.png hxxps[:]//js-static[.]cfd/c.js?embed=__JNJ_4__& lp=%2F& |
| url | https://js-static.cfd/static/CF-Logo%201.png | 897f-541144bf0b7d hxxps[:]//js-static[.]cfd/api/track/event hxxps[:]//js-static[.]cfd/static/CF-Logo%201.png hxxps[:]//js-static[.]cfd/static/fonts/jetbrains-mono-6 |
| url | https://js-static.cfd/static/fonts/jetbrains-mono-600.woff2 | rack/event hxxps[:]//js-static[.]cfd/static/CF-Logo%201.png hxxps[:]//js-static[.]cfd/static/fonts/jetbrains-mono-600.woff2 hxxps[:]//js-static[.]cfd/static/cf_dark_horizontal.png |
From the original article
1 min read at isc.sans.edu
On Wednesday, 2026-10-28, I ran across a ClickFix campaign I haven't seen before. Like several other ClickFix campaigns, this one uses a fake Cloudflare verification page. It targets both macOS and Windows.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.