Attackers compromised hundreds of legitimate websites and injected code that sent visitors to a fake Cloudflare page. The fake page used a “ClickFix” trick to convince users to run steps that installed malware. The incident shows how criminals can use trusted brands and trusted sites as the delivery mechanism, not just as a reputational issue.
Attackers compromised legitimate, trusted websites and injected code that redirected visitors to a fake Cloudflare verification page. Rather than a normal CAPTCHA, the page walked users through steps framed as a browser "fix" or security check. Following those steps resulted in malware being installed on the visitor's device, a technique known as ClickFix. Researchers found the same injected code running across hundreds of unrelated sites, all feeding shared attacker infrastructure, which suggests a coordinated campaign rather than isolated incidents.
The campaign worked because it exploited trust in two layers at once: trust in the compromised website itself, and trust in Cloudflare as a security brand that many users already associate with legitimate verification prompts. Visitors were not clicking a suspicious link in an email, they were visiting sites they already trusted, including institutions like Harvard, Oxford, and DuckDuckGo. That combination made the fake verification step feel like a routine part of browsing rather than an attack.
Organizations and individuals should treat any prompt asking them to "fix" or manually resolve a browser issue as a red flag, regardless of how legitimate the branding looks. Employees, students, faculty, and customers should be reminded that trusted brands and trusted sites can be used against them, since attackers in this case are described as posing as something users already trust. Security teams should also recognize that blocking a single malicious URL inside the corporate perimeter does not remove the underlying infrastructure; the article notes this can lead to a whack-a-mole cycle where blocked links simply reappear elsewhere. Reporting suspicious pages and supporting broader takedown efforts is more effective than local blocking alone. Given that this incident spans education, online platforms, retail, and financial services, awareness training should extend beyond IT and security staff to include marketing, brand, and legal teams who may be first to notice brand impersonation affecting their own organization's web presence.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a technique where a fake Cloudflare verification page tricks visitors into manually running steps that install malware on their device.
Researchers found that attackers poisoned more than 700 websites, including sites run by Harvard, Oxford, and DuckDuckGo.
No. Blocking a phishing URL internally only stops it from resolving inside your own perimeter, but the broader attacker infrastructure remains active and can resurface elsewhere.
It shows that trusted brands and trusted websites can be turned into delivery mechanisms for malware, meaning trust alone is not a reliable safety signal for users.
You land on Harvard’s website, and suddenly a Cloudflare ‘Security Check’ pops up, telling you to fix your browser. Researchers found more than 700 poisoned sites, even Harvard, Oxford, and DuckDuckGo, showing this fake Cloudflare page that walks you through a ‘ClickFix’ step to silently install malware. Here’s the trick: real Cloudflare checks are just quick loading or a CAPTCHA. If a ‘Cloudflare’ page tells you to download, run commands, or change settings on your computer, that’s not protection, that’s the attack. If any ‘Cloudflare’ page on a website asks you to run steps on your device, stop immediately and report it to security, don’t click through a ClickFix into malware.
Microsoft reported a real-world campaign (“TerminalFix”) where attackers use compromised websites to show a fake Cloudflare CAPTCHA. The prompt tricks visitors into copying and running a malicious PowerShell/Terminal command, which then installs a reverse-tunnel backdoor that can give attackers…
Threat actors are using fake CAPTCHA pages on compromised or lookalike websites to trick people into copying and pasting malicious commands (“paste and run”). The article describes real campaigns tied to CastleLoader and similar activity, including fake background-removal sites and job-site…
Researchers reported four separate espionage groups using the same “BlueMoon” exploit kit within days, targeting organizations in the US and Southeast Asia. The attacks began with phishing emails that lured recipients to attacker-controlled websites, where Chrome and Windows vulnerabilities were…
Cisco Talos investigated a real infection chain seen at a Ukrainian government organization where a disguised DLL was executed directly from a WebDAV network path. Attackers used a compromised website to show a fake Google CAPTCHA-style “verification” prompt that tricks users into running a copied…
Investigators described a real, long-running SEO poisoning operation (“BengalSEO”) that manipulates search results to push victims to fake support and activation pages. The pages impersonate well-known consumer brands, then route visitors through redirects and CAPTCHA checks to either download…
A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then…
