Hackers Turn Compromised Websites Into Fake Cloudflare Verification Traps for Windows and Mac Users

Attackers are using compromised websites to present fake Cloudflare verification pages that steer Windows and macOS users toward executing malicious commands.

The findings establish a delivery attempt, not a confirmed infection or identified malware family.

The activity exploits the familiarity of browser security checks. Instead of completing a legitimate verification, visitors receive instructions intended to move execution outside the browser and onto their computers.

Duncan observed different instructions when viewing the lure from Windows and macOS hosts, demonstrating that the campaign accommodates both operating systems.

Duncan withheld the identity of the legitimate compromised website that triggered his investigation.

That observation offers investigators a discovery pivot, although it does not establish how many websites were compromised.

Resource provides a useful hunting indicator for defenders reviewing browser histories, proxy telemetry, or unexpected external scripts loaded by websites.

SANS Internet Storm Center researcher documented, the previously unnamed ClickFix campaign on October 28, 2026, but could not retrieve either platform’s intended malware payload.

Its appearance should prompt investigation in context rather than an automatic conclusion that malware successfully executed.

Fake Cloudflare Verification Traps

When Duncan executed the command in his test environment, the hosting server returned an HTTP 403 Forbidden response, preventing further analysis of the intended delivery chain.

Domain failed to resolve during testing, again stopping the investigation before payload retrieval.

Neither failure establishes that the campaign was harmless or permanently inactive; both describe the infrastructure’s behavior during the researcher’s observations.

ClickFix persuades users to perform the dangerous action themselves. Microsoft describes the technique as presenting an apparent problem or verification requirement, then directing victims to run attacker-supplied commands.

Windows campaigns commonly use the Run dialog, while macOS variants access can instruct users to execute commands through Terminal.

These are characteristics of the broader technique, not independently verified command details for Duncan’s campaign.

Related reporting illustrates the potential consequences without identifying this campaign’s payload.

Microsoft has documented separate macOS ClickFix operations delivering information stealers and a TerminalFix operation using compromised websites, fake Cloudflare overlays, PowerShell, DLL sideloading, and reverse tunneling.

Those investigations demonstrate the delivery method’s flexibility, but do not establish shared operators or infrastructure with this newly reported activity.

The absence of recovered samples leaves the final malware, persistence mechanisms, collection capabilities, and operator identity unresolved.

Defenders should therefore distinguish the published delivery indicators from claims about downstream compromise, which the available evidence does not support.

For user awareness, the decisive warning sign is a verification page requesting command execution. Legitimate CAPTCHA completion should not require opening Run, PowerShell, or Terminal and pasting instructions.

University of Rochester guidance specifically warns that such prompts can retrieve or execute malware.

Security teams can use the disclosed domains as starting points, then correlate relevant browsing activity with command execution and outbound connections.

Investigation should prioritize whether users followed the lure, rather than treating a blocked download or unresolved domain as proof that every affected endpoint remained uncompromised.

IOCs

No.	URL
1	hxxps[:]//js-static[.]cfd/embed.js?v=24
2	hxxps[:]//js-static[.]cfd/api/s/on?site=[information removed].com
3	hxxps[:]//js-static[.]cfd/api/s/hit
4	hxxps[:]//js-static[.]cfd/api/s/hit
5	hxxps[:]//js-static[.]cfd/api/track/event

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.