Threat reportPhishingTL-2026-4658
ClickFix Campaign Using Fake Cloudflare Verification Page Against macOS and Windows (js-static.cfd / cf-id.com / api-com.cfd)
ClickFix Campaign Using Fake Cloudflare Verification Page (TL-2026-4658), also tracked as Fake Cloudflare ClickFix, is a medium-severity phishing campaign, first published 2026-10-28. It has no confirmed attribution, affects Microsoft Windows, maps to 7 MITRE ATT&CK techniques (T1036, T1059.001, T1059.004), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-4658
- Threat ID
- TL-2026-4658
- Also known as
- Fake Cloudflare ClickFix
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- general-users, consumers, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
How ClickFix Campaign Using Fake Cloudflare Verification Page works
SANS ISC (Brad Duncan, 2026-10-28) documents a previously unseen ClickFix campaign that injects a fake Cloudflare verification page with platform-specific instructions to trick macOS and Windows users into running a command. On the day of analysis the Windows command URL returned HTTP 403 and the macOS command domain did not resolve, so no payload was retrieved.
On 2026-10-28 Brad Duncan published a SANS Internet Storm Center diary describing another ClickFix campaign. A script hosted on js-static[.]cfd is loaded by affected websites (embed.js?v=24 and c.js with an embed identifier parameter) and renders a counterfeit Cloudflare verification page. Associated traffic includes multiple /api/s/ and /api/track/event endpoints plus static resources (fonts, logos, PNG images). The page presents platform-specific instructions: the macOS ClickFix command references https://cf-id.com/?ray-id=nz0ovm2jq2g68i and the Windows ClickFix command references https://api-com.cfd/7ge0w58tzzjsv9.
The analyst could not obtain a payload. The Windows command URL returned 403 Forbidden and the macOS domain failed to resolve at the time of testing. The sample therefore does not reveal the malware family, final-stage behavior, C2 protocol or actor. The source states no CVE, CVSS score, malware family or attribution; severity here is analyst-assigned. The source suggests pivoting on js-static[.]cfd in urlscan to identify legitimate websites that load the script.
Context from public reporting on the ClickFix technique (not tied to these domains): ClickFix pages commonly detect the visitor's OS, copy a command to the clipboard via JavaScript and instruct the user to paste and run it (PowerShell/mshta-style living-off-the-land commands on Windows, shell commands on macOS/Linux). Push Security (via BleepingComputer, 2025-11-06) documented multi-OS variants with video tutorials, countdown timers and malvertising/SEO-poisoning distribution. Malwarebytes (2026-07) documented fake Google/Cloudflare verification pages delivering families such as StealC, HijackLoader and NetSupport RAT. No evidence links the 2026-10-28 infrastructure to those campaigns. BeaconBeagle returned no C2 config or beacon matches for js-static.cfd, and web searches found no other public reporting on these three domains.
Defender focus: the execution step is user-initiated paste-and-run, so detection should centre on clipboard-write behavior from web pages, terminal/PowerShell/Run-dialog child processes of browsers' paste actions, and network requests to the listed domains.
MITRE ATT&CK techniques used in TL-2026-4658
Defense Evasion
Execution
T1059.001 PowerShell; T1059.004 Unix Shell; T1059.007 JavaScript; T1204.004 Malicious Copy and Paste
Resource Development
Affected products and versions in ClickFix Campaign Using Fake Cloudflare Verification Page
Remediation for ClickFix Campaign Using Fake Cloudflare Verification Page
Immediate actions
- Block js-static.cfd, cf-id.com and api-com.cfd at DNS, proxy and email/web gateways
- Search proxy/DNS/EDR telemetry for requests to the listed domains and URLs and investigate any host that contacted cf-id.com or api-com.cfd
- Use urlscan to pivot on js-static.cfd to identify websites loading the injected script; notify site owners
Workarounds
- Disable the Windows Run dialog via policy where operationally feasible
- Apply application control / PowerShell Constrained Language Mode for non-admin users
Longer-term hardening
- Train users that legitimate Cloudflare verification never asks them to paste commands into Terminal, PowerShell or the Run dialog
- Restrict or alert on PowerShell/mshta launched from the Run dialog and on interactive Terminal pastes of curl/bash one-liners on macOS
- Deploy browser protections that warn when a page writes to the clipboard
Timeline of ClickFix Campaign Using Fake Cloudflare Verification Page
- ClickFix technique reported as widely used from approximately August 2024 (month-level date), initially targeting mainly Windows users
- BleepingComputer, citing Push Security, reports ClickFix pages with OS detection, fake Cloudflare CAPTCHA, countdown timers and video tutorials for Windows, macOS and Linux
- SANS ISC publishes the diary 'Yet Another ClickFix Campaign' with IOCs and a urlscan pivot suggestion on js-static[.]cfd
- Windows ClickFix command URL on api-com[.]cfd returned HTTP 403 Forbidden; no payload retrieved
- macOS ClickFix command domain cf-id[.]com failed to resolve during analysis; no payload retrieved
- Brad Duncan observes a new ClickFix campaign using js-static[.]cfd to inject a fake Cloudflare verification page with macOS and Windows instructions
Sources cited for ClickFix Campaign Using Fake Cloudflare Verification Page
- Yet Another ClickFix Campaign (SANS ISC diary, Brad Duncan)
- ClickFix malware attacks evolve with multi-OS support, video tutorials (BleepingComputer)
- Fake Google and Cloudflare verification pages spread multiple malware families (Malwarebytes)
- Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic (SOC Prime / Sekoia)
- ClickFix: The Attack That Turns Users Into Their Own Attackers (Check Point)
- ClickFix (Wikipedia)
Detection coverage for TL-2026-4658
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4658 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.