Essential Insights
- Fake Cloudflare verification pages used ClickFix instructions to target both Windows and macOS users.
- The instructions directed victims to fetch malware; delivery failed during analysis (403 on Windows, unresolved domain on macOS).
- The campaign was injected through compromised legitimate websites; key indicators include
js-static[.]cfd,api-com[.]cfd, andcf-id[.]com.
Threat, Attack Techniques, and Targets
On October 28, 2026, researchers observed a ClickFix campaign that used a fake Cloudflare verification page. The activity targeted both Windows and macOS users through a legitimate but compromised website. The page prompted visitors to run a command, a tactic that could lead to malware delivery.
However, researchers could not retrieve the malware. On Windows, the hosting server returned a 403 Forbidden error. On macOS, the command’s domain did not resolve.
- Fake page host:
js-static[.]cfd - Windows command URL:
hxxps[:]//api-com[.]cfd/7ge0w58tzzjsv9 - macOS command URL:
hxxps[:]//cf-id[.]com/?ray-id=nz0ovm2jq2g68i
Impact, Security Implications, and Remediation
The campaign attempted to persuade users to run commands. However, the researchers could not confirm malware delivery or determine the payload’s impact. Therefore, treat unexpected verification prompts that ask you to run commands as suspicious.
Do not run commands from untrusted web pages. Security teams can review network logs for the listed indicators. The source provides no further remediation guidance, so consult the relevant vendor or cybersecurity authority for additional advice.
Continue Your Tech Journey
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
