Researchers Identify New ClickFix Malware Campaign
A malicious campaign leverages fake Cloudflare verification pages to target both macOS and Windows users.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you trust your ability to identify fake website verification pages when browsing the internet?
A cybersecurity researcher has identified a new ClickFix malware campaign that utilizes a deceptive Cloudflare verification page. The campaign actively targets users across both macOS and Windows operating systems.
Why it matters
The campaign uses social engineering by instructing users to execute malicious commands under the guise of security verification. This approach demonstrates a persistent threat to users who may be tricked into compromising their own systems.
The campaign employs a JavaScript file to deliver fake instructions and operates through tracking and API endpoints on the domain js-static[.]cfd. A Windows host execution attempt returned a 403 Forbidden status code.
The players
Cloudflare
Cloudflare is a global company providing content delivery network services, DDoS mitigation, and internet security that is frequently impersonated in phishing campaigns.
The details
The attackers use a fake verification interface to prompt users into running scripts that execute malware. While the Windows malware server returned a 403 error during testing, the macOS malware server domain failed to resolve entirely.
Timeline
- 2026-10-28
Researcher observed the ClickFix campaign activity.
The Tech Race
The use of the Cloudflare verification page for social engineering represents a common tactic in modern web-based malware campaigns. This activity highlights the ongoing evolution of attacker strategies that abuse established security services to bypass user suspicion.
Users should exercise extreme caution when prompted to run command-line instructions as part of a web verification process. Following these unauthorized instructions could lead to system compromise or the installation of malicious software.
The takeaway
Always verify the source of any security instructions, as legitimate services will not typically require you to manually execute code to verify your connection. If a website asks you to run terminal commands or copy-paste scripts, treat it as a significant security risk.
Further reading
For more information on emerging digital threats, visit our Cybersecurity section.
Source note: This article includes information reported by SANS Internet Storm Center.
Live Poll
Do you trust your ability to identify fake website verification pages when browsing the internet?
