Unnamed ClickFix lures use fake Cloudflare checks; payloads unrecovered
October 29: Cyber Security News adds that Duncan says URLscan shows more than one compromised site and that embed.js calls time-zone, location and IP endpoints. Payloads remain unrecovered.
A previously unseen ClickFix campaign fakes Cloudflare checks on compromised sites, but neither Windows nor macOS payload was recovered.
A previously unseen ClickFix campaign observed on October 28, 2026 overlays fake Cloudflare “Verify you are human” pages on compromised legitimate websites and tells Windows and macOS visitors to run commands outside the browser. SANS Internet Storm Center handler Brad Duncan tied the fake-page script to js-static.cfd/embed.js, which calls time-zone, location and IP endpoints. The Windows command pointed at api-com.cfd and returned HTTP 403; the macOS command pointed at cf-id.com, which did not resolve, so neither payload was obtained and the malware remains unknown. The first site’s identity was withheld. Duncan says URLscan hits suggest more than one compromised site, and GBHackers reports the activity is not tied to earlier ClickFix operations.
- Activity observed October 28, 2026; Duncan had not seen this specific campaign before.
- Fake-page traffic starts at js-static.cfd/embed.js, plus tracking endpoints.
- Windows lure used api-com.cfd and received HTTP 403 Forbidden.
- macOS lure used cf-id.com, which did not resolve.
- URLscan hits suggest more than one compromised site; the first site was not named.
- GBHackers says the report does not link this to earlier ClickFix malware.
Timeline
dated events in the reporting · oldest first- Oct 28, 2026SANS observes unnamed ClickFix fake Cloudflare pages · SANS Internet Storm Center
What each outlet adds
beyond the shared facts- SANS Internet Storm CenterPrimary observation: 403 and failed DNS, so no payloads.
- GBHackersSays the activity is not linked to earlier ClickFix operations.
- Cyber Security NewsURLscan implies multiple sites; embed.js tracking endpoints.
- Vendors
- Cloudflare
- Malware
- LUNEXSTEALER
- Organizations
- SANS Internet Storm CenterMicrosoftCERT-UA
Coverage
oldest first · one row per article · UTC- · 2d ago
SANS Internet Storm CenterFirst report
Unnamed ClickFix campaign uses fake Cloudflare checks on Windows and macOS
The researcher could not retrieve either payload: Windows returned 403 and the macOS malware domain did not resolve.
- · 1d ago
GBHackers
Fake Cloudflare checks on hacked sites push ClickFix commands
SANS could not retrieve the Windows or macOS payload after test fetches returned HTTP 403 or failed to resolve.
- · 1d ago
Cyber Security News
Fake Cloudflare checks push ClickFix commands to Windows and Mac users
Commands pointed to api-com.cfd and cf-id.com, but neither yielded a payload, so the malware remains unknown.