Hackers Use Fake Cloudflare Verification Pages to Target Windows and Mac Users

A new ClickFix campaign is using fake Cloudflare verification pages to trick both Windows and Mac users into running harmful commands on their own computers.

The pages look like the “Verify you are human” checks that many people click through every day. Instead of a quick security check, the visitor ends up starting an infection by hand.

The campaign was seen on Wednesday, October 28, 2026, and it runs on legitimate websites that have been compromised. A visitor lands on a normal-looking site, and a hidden script loads the fake Cloudflare page on top of it.

Since the page shows different steps for each operating system, the trick works on Windows and macOS alike. It is a useful reminder that fake Cloudflare human check pages are still a favorite lure.

Researchers at the Internet Storm Center noted the activity. Handler Brad Duncan ran across it and published a diary entry titled “Yet Another ClickFix Campaign” on the SANS Internet Storm Center site.

Researcher said he had not seen this specific activity before and has not given it a name yet. He shared screenshots and indicators, and the full ISC diary is worth reading for the raw details.

Hackers Use Fake Cloudflare Verification Pages

The chain starts on the compromised website. A script loaded from the domain js-static[.]cfd runs in the visitor’s browser. Duncan saw the script call many paths on that domain, including ones that appear to check the visitor’s time zone, location and IP address.

It also loads a Cloudflare logo and fonts so the page looks real. This kind of tracking likely helps the attackers decide what to show each visitor, though the diary does not confirm that.

Next, the fake page tells the visitor to run a command to finish the “verification.” This is the core of ClickFix. No software flaw is used, and no file is downloaded.

The person does the risky step themselves, which helps the attack get past many security tools. Earlier reports on Windows and macOS users show the same split, where each system gets its own set of instructions.

In this case, Windows and Mac visitors saw different commands. The Windows command pointed to api-com[.]cfd, and the Mac command pointed to cf-id[.]com.

Duncan could not follow either one to the end. When he ran the Windows command, the server answered with a “403 Forbidden” error. On the Mac side, the domain did not resolve at all. As a result, the final malware for both systems is still unknown.

Duncan also removed the name of the compromised site from his report. He noted that searching for js-static[.]cfd in URLscan should turn up several other sites likely to produce the same traffic. That suggests the campaign is not limited to a single victim website.

Why ClickFix Keeps Working and How to Stay Safe

ClickFix keeps working because it uses trust instead of technical tricks. Most people know Cloudflare’s check and expect it to be harmless.

The fake version only adds one odd request, which is to paste something into Windows or Terminal. Many people follow a prompt like that without thinking, especially on a site they already know.

Other campaigns show how far this has spread. CERT-UA recently reported that more than 100 hacked sites pushed LUNEXSTEALER fake Cloudflare checks to Windows visitors.

Mac users are also targeted, and Apple has started to respond. Newer macOS versions now warn users with Apple’s Terminal paste protection when a suspicious command is pasted.

The best defense is a simple rule. A real Cloudflare check never asks you to open the Run box, PowerShell or Terminal. If a site asks for that, close the tab.

Companies can also block the Windows Run dialog through group policy, watch for odd PowerShell or Terminal activity, and block the domains listed below. Website owners should check their pages for unknown scripts, since the attackers rely on hacked sites to reach visitors.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use Fake Cloudflare Verification Pages to Target Windows and Mac Users appeared first on Cyber Security News.