A real ClickFix campaign used compromised websites to display fake Cloudflare “Verify you are human” pages. The pages instructed Windows and macOS visitors to run commands as part of a supposed verification process, directing them to attacker-controlled domains. The final malware was not identified, but the campaign relies on convincing people to execute the harmful step themselves.
This campaign relied on compromised websites rather than attacker-owned infrastructure. A visitor would land on a normal-looking site, unaware that a hidden script was loading a fake Cloudflare verification overlay on top of the page. The overlay copied Cloudflare's logo and fonts to appear credible, then presented the familiar "verify you are human" prompt.
Instead of a standard CAPTCHA, the page instructed visitors to open the Windows Run box or PowerShell, or on Mac systems, Terminal, and paste in a command to complete the supposed verification. Windows visitors were directed to a command pointing to api-com[.]cfd, while macOS visitors saw a different command pointing to cf-id[.]com. Researchers were unable to confirm the final payload because the Windows address returned a 403 Forbidden response and the macOS domain did not resolve during analysis.
The attack's strength was in what it did not require: no exploit, no malicious download triggered automatically, no obvious technical red flag for traditional security tools to catch. The victim performs the risky step themselves, which lets the activity slip past defenses built to catch automated or silent compromise.
Familiiarity also played a role. Many people encounter CAPTCHA-style checks constantly and follow prompts like this without much thought, especially on a site they already trust or have visited before. The convincing branding reinforced that false sense of legitimacy, and the operating-system-specific commands meant the lure worked regardless of whether the visitor used Windows or macOS.
The most effective defense is a simple rule: a legitimate human-verification check will never ask a visitor to run a command. If a page requests that, the browser tab should be closed immediately rather than following the instructions.
Organizations should also reinforce that command-execution requests from websites are inherently suspicious, regardless of how familiar or trustworthy the site appears. Website owners and IT teams have a role too, since this campaign depended entirely on hidden scripts injected into compromised, otherwise legitimate pages. Routine checks for unknown or unexpected scripts can help catch this kind of abuse before it reaches visitors. Technique references: T1656 and T1204.002 at attack.mitre.org describe the impersonation and user-execution methods used here.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers compromised legitimate websites and overlaid them with a fake Cloudflare human-verification page that used real branding, logos, and fonts to look authentic, then instructed visitors to run a command to complete the check.
Windows visitors were given a command pointing to api-com[.]cfd, while macOS visitors were directed to a different command pointing to cf-id[.]com, so the same trick worked across both operating systems.
Because the victim executes the risky command themselves, which helps the attack get past many security tools that would normally flag malicious scripts or downloads.
Close the tab immediately, since a real Cloudflare check never asks a visitor to open the Run box, PowerShell, or Terminal.
A familiar website suddenly says, ‘Verify you are human.’ It looks like Cloudflare, logo and fonts included. But this ClickFix trick asks Windows users to open Run or PowerShell, and Mac users to open Terminal, then paste a command. That’s the giveaway: a real Cloudflare check stays in your browser. Here, the Windows command points to api-com[.]cfd; the Mac one points to cf-id[.]com. A website asking you to run a command isn’t verifying you. Close the tab.
Criminals compromised legitimate websites and replaced normal content with fake verification pages designed to persuade visitors to install malware. The pages use familiar frustrations, such as a blocked video, a browser problem, or a security check, to pressure people into running commands or…
An unknown group suspected to be North Korean state hackers targeted Rust language team members and high-profile package (“crate”) maintainers with phishing that lures victims into a fake conference call. When the victim tries to join, they are told they must install a “video codec” or update…
Researchers found 737 Chrome VPN/proxy extensions that impersonated well-known privacy brands and routed users’ browser traffic through attacker-controlled SOCKS5 proxies. The activity mainly targeted Russian-speaking users trying to access blocked services, putting the operator in a position to…
Attackers sent personalized fake federal court notices to more than 100,000 companies, impersonating the US District Court for the Southern District of Florida. The emails directed recipients to a counterfeit court website and offered a password-protected case file that ultimately installed…
Google is adding Chrome warnings to help stop ClickFix scams, where criminals persuade people to copy and run harmful commands under the guise of fixing a routine browser or verification problem. The scams commonly use fake Cloudflare or Google reCAPTCHA pages, then direct victims to paste a…
Researchers found macOS users being tricked into installing a fake Zoom app that actually installs a persistent backdoor called CloudSyncD. The installer guides the victim through a normal-looking setup and prompts for the user’s password so it can run with elevated privileges and stay on the Mac…
