ClickFix campaign uses compromised websites to serve fake Cloudflare verification pages to Windows and macOS users
Attackers are using compromised websites to show fake Cloudflare verification pages that push Windows and macOS visitors into running malicious commands themselves, a ClickFix technique. The campaign was documented by researcher Duncan of the SANS Internet Storm Center on October 28, 2026. He saw different instructions for Windows and macOS hosts. He could not retrieve a payload: the hosting server returned HTTP 403 Forbidden and a domain failed to resolve. The report therefore establishes a delivery attempt only, with no confirmed infection, malware family or operator identity.
Detalhes técnicos
- Victims get a fake browser verification check and are told to run attacker-supplied commands outside the browser. On Windows this is typically the Run dialog; on macOS it is Terminal. The article presents these as traits of the broader technique, not verified details of this campaign.
- The legitimate compromised site that triggered the investigation was not disclosed, and the number of compromised sites is unknown.
- The 403 response and the unresolved domain describe infrastructure behavior during testing. They do not show the campaign is harmless or inactive.
- Microsoft has documented separate macOS ClickFix operations delivering infostealers, and a TerminalFix operation using compromised sites, fake Cloudflare overlays, PowerShell, DLL sideloading and reverse tunneling. The article does not link them to this activity.
- The article refers to disclosed defanged domains but does not list them.
Remediação
- Train users that a CAPTCHA or verification page should never ask them to open Run, PowerShell or Terminal and paste a command.
- Hunt through browser history, proxy telemetry and unexpected external scripts on websites using the disclosed domains as pivots. Correlate visits with command execution and outbound connections.
- Do not treat a blocked download or unresolved domain as proof an endpoint was not compromised. Prioritize whether users followed the lure.
Linha do tempo
-
ClickFix campaign uses compromised websites to serve fake Cloudflare verification pages to Windows and macOS users
ler a análise desta fonte ocultar
Attackers are using compromised websites to show fake Cloudflare verification pages that push Windows and macOS visitors into running malicious commands themselves, a ClickFix technique. The campaign was documented by researcher Duncan of the SANS Internet Storm Center on October 28, 2026. He saw different instructions for Windows and macOS hosts. He could not retrieve a payload: the hosting server returned HTTP 403 Forbidden and a domain failed to resolve. The report therefore establishes a delivery attempt only, with no confirmed infection, malware family or operator identity.
Technical Details
- Victims get a fake browser verification check and are told to run attacker-supplied commands outside the browser. On Windows this is typically the Run dialog; on macOS it is Terminal. The article presents these as traits of the broader technique, not verified details of this campaign.
- The legitimate compromised site that triggered the investigation was not disclosed, and the number of compromised sites is unknown.
- The 403 response and the unresolved domain describe infrastructure behavior during testing. They do not show the campaign is harmless or inactive.
- Microsoft has documented separate macOS ClickFix operations delivering infostealers, and a TerminalFix operation using compromised sites, fake Cloudflare overlays, PowerShell, DLL sideloading and reverse tunneling. The article does not link them to this activity.
- The article refers to disclosed defanged domains but does not list them.
Remediation
- Train users that a CAPTCHA or verification page should never ask them to open Run, PowerShell or Terminal and paste a command.
- Hunt through browser history, proxy telemetry and unexpected external scripts on websites using the disclosed domains as pivots. Correlate visits with command execution and outbound connections.
- Do not treat a blocked download or unresolved domain as proof an endpoint was not compromised. Prioritize whether users followed the lure.