Fake Cloudflare Verification Pages Used in New ClickFix Attacks
Hackers are mimicking Cloudflare’s human‑verification prompts to trick users into running malicious commands.
What the attack looks like
Cybercriminals are exploiting the familiarity of Cloudflare verification pages. A compromised website shows a fake verification box that claims the process is taking longer than usual.
When the user clicks the box, a message appears instructing them to run a specific command to “speed up” the check. The command differs depending on whether the visitor is on a Windows PC or a Mac.
How the ClickFix campaign works
There is no software vulnerability or malicious file involved.
The attack relies entirely on social engineering: the victim copies and executes a command on their own device.
Executing the command can download malware or give the hacker remote access.
The instructions also appear designed to capture the visitor’s location and IP address.
Scope of the threat
The report notes that the fake verification has been deployed across multiple compromised sites, meaning users may encounter it on more than one domain.
What users should do
Legitimate Cloudflare checks typically involve simple actions such as clicking a box or completing a CAPTCHA. Users should never open a terminal, command prompt, or Run box in response to a verification request.
Staying aware of this tactic can help prevent unauthorized access and malware infections.
