Hackers are employing a fresh tactic dubbed “ClickFix,” using counterfeit Cloudflare verification pages to fool both Windows and macOS users into executing dangerous commands. Posing as “human verification” pages—a familiar blur most of us click through without thinking—these fake checks are being injected into legitimate websites that have been compromised.
The Social Engineering Behind the Attack
The campaign was first observed on October 28, 2026. Visitors to affected sites see what appears to be Cloudflare’s standard “verify you are human” prompt. In reality, a hidden script—loaded from a domain called js-static[.]cfd—is pulling in assets like the Cloudflare logo, fonts, and tracking APIs. These are used to check the user’s IP, time zone, and location, which help the attackers tailor the ruse for either Windows or macOS users.
After building trust, the page presents instructions for running a command in Command Prompt, PowerShell, or Terminal—depending on the operating system. These are not vulnerabilities being exploited, but a classic example of social engineering: the user is convinced to do the risky step themselves.
What is Known so Far—and What Isn’t
Windows users receive a command using api-com[.]cfd, while Mac users are directed toward cf-id[.]com. When tested, neither led to any malware payloads being conclusively identified. The Windows URL returned a 403 Forbidden error, and the Mac URL failed to resolve. That means the final stage of infection—what happens if someone actually runs the commands—is still unclear.
The campaign appears to be widespread. Numerous legitimate sites are believed to be affected; searching for js-static[.]cfd in community tools reveals many more that have been compromised. The tactic leans heavily on human trust and the recognizability of Cloudflare’s verification flows.
Defense: How to Recognize and Block ClickFix
True Cloudflare verification doesn’t ask you to open elevated system tools like PowerShell or Terminal. If a page directs you to use those, close the tab immediately. For system administrators, blocking access to dangerous domains (like js-static[.]cfd, api-com[.]cfd, cf-id[.]com) and locking down group policy to restrict “Run,” “PowerShell,” or Terminal activity can help.
Apple is adding new protections in recent macOS releases: Terminal now warns users if a suspicious command is pasted, which can catch some of these attacks in the act. Meanwhile, organizations should check their sites for unknown scripts, since compromised sites are the entrypoints for this scheme.
Key Indicators of Compromise
Some technical red flags to watch:
- The malicious script is hosted on
js-static[.]cfd. - Tracking URLs include paths like
/api/s/tz,/api/s/geo,/api/s/ip, among others. - Hosts are loading familiar Cloudflare assets like its logo and fonts.
- Commands reference domains that either refuse connection (403 Forbidden) or fail to resolve.
Also force-out bad scripts via web security tools, and educate users to never trust terminal prompts or “Paste this command” instructions on unfamiliar verification pages.
ClickFix works because it mimics something we’ve learned to trust. As long as Cloudflare-style verifications are common and rarely dangerous, there’ll be people who click without thinking. That renders technical safeguards less effective if the attack relies on human compliance. Educating users, hardening endpoints, and monitoring scripts on websites are all critical. What to watch next: whether attackers deliver an actual payload this time, or whether defenses like macOS’s Terminal warnings begin to deter this phishing-as-script campaign for good.
