ClickFix Campaign Uses Fake Cloudflare Page to Target macOS and Windows Users
A new ClickFix campaign has been identified, employing a deceptive Cloudflare verification page to lure both macOS and Windows users into potential compromise.
A recently observed ClickFix campaign is employing a sophisticated social engineering tactic, presenting users with a fake Cloudflare verification page. This campaign, first noted on October 28th, 2026, targets both macOS and Windows operating systems, aiming to trick individuals into downloading and executing malicious payloads.
The campaign leverages a domain, js-static[.]cfd, for its malicious infrastructure. When users interact with the fake verification page, they are presented with instructions that appear legitimate, designed to prompt further action. However, the underlying goal is to deliver malware to the victim's system.
Researchers attempting to retrieve the malware payload encountered difficulties. On Windows systems, the server hosting the malware responded with a "403 Forbidden" error, preventing direct access. For macOS users, the domain associated with the malware download did not resolve, indicating potential instability or deliberate obfuscation of the malicious infrastructure.
Despite the inability to retrieve the exact malware, the observed URLs provide valuable indicators of the campaign's activity and communication patterns. These indicators include requests to various API endpoints on the js-static[.]cfd domain, such as /embed.js, /api/s/on, /api/s/hit, and /api/track/event, suggesting a complex command-and-control or data exfiltration mechanism.
Further analysis of the URLs reveals the use of static assets like Cloudflare logos and font files, likely to enhance the legitimacy of the fake verification pages. The campaign also appears to track user interactions and potentially gather information through various API calls related to geolocation, IP addresses, and session data.
The campaign's reliance on a fake Cloudflare page is a common tactic, exploiting the widespread use and trust associated with Cloudflare's services for website security and performance. By impersonating a trusted entity, attackers increase the likelihood of users falling victim to their schemes.
While the specific malware payload remains elusive, the methodology employed by this ClickFix campaign highlights the persistent threat of social engineering and the evolving tactics used by threat actors to distribute malware. Users are advised to remain vigilant against unsolicited verification requests and to ensure their systems are protected with up-to-date security software.
Further investigation into the compromised websites that generated this traffic may reveal more about the campaign's scope and the ultimate objectives of the attackers. Security professionals are encouraged to monitor the indicators provided and to update their defenses against similar phishing and malware distribution techniques.