As cited
Copy frozen at (site build).
threat intel
Yet Another ClickFix Campaign
A researcher identified a ClickFix campaign on October 28, 2026, that impersonates Cloudflare verification pages and targets both Windows and macOS users. The attack chain uses a fake verification page hosted on js-static[.]cfd to deliver malware, though the researcher was unable to retrieve the final payloads due to a 403 Forbidden response on Windows and a non-resolving domain on macOS. The post provides indicators of compromise, including URLs and domains associated with the fraudulent verification infrastructure.
Why it matters: Security teams should block the identified domains and URLs to prevent users from being socially engineered into executing malicious commands; ClickFix attacks exploit user trust in familiar brands and can lead to malware installation on both platforms.
- Source published
- First seen by Cybersecurity Tracker