# ClickFix Campaign Using Fake Cloudflare Verification Page Against macOS and Windows (js-static.cfd / cf-id.com / api-com.cfd)

> SANS ISC (Brad Duncan, 2026-10-28) documents a previously unseen ClickFix campaign that injects a fake Cloudflare verification page with platform-specific instructions to trick macOS and Windows users into running a command. On the day of analysis the Windows command URL returned HTTP 403 and the macOS command domain did not resolve, so no payload was retrieved.

- **Published:** 2026-10-28T16:40:11Z
- **Last reviewed:** 2026-10-28T16:40:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4658
- **ID:** TL-2026-4658
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-28 Brad Duncan published a SANS Internet Storm Center diary describing another ClickFix campaign. A script hosted on js-static[.]cfd is loaded by affected websites (embed.js?v=24 and c.js with an embed identifier parameter) and renders a counterfeit Cloudflare verification page. Associated traffic includes multiple /api/s/ and /api/track/event endpoints plus static resources (fonts, logos, PNG images). The page presents platform-specific instructions: the macOS ClickFix command references https://cf-id.com/?ray-id=nz0ovm2jq2g68i and the Windows ClickFix command references https://api-com.cfd/7ge0w58tzzjsv9.

The analyst could not obtain a payload. The Windows command URL returned 403 Forbidden and the macOS domain failed to resolve at the time of testing. The sample therefore does not reveal the malware family, final-stage behavior, C2 protocol or actor. The source states no CVE, CVSS score, malware family or attribution; severity here is analyst-assigned. The source suggests pivoting on js-static[.]cfd in urlscan to identify legitimate websites that load the script.

Context from public reporting on the ClickFix technique (not tied to these domains): ClickFix pages commonly detect the visitor's OS, copy a command to the clipboard via JavaScript and instruct the user to paste and run it (PowerShell/mshta-style living-off-the-land commands on Windows, shell commands on macOS/Linux). Push Security (via BleepingComputer, 2025-11-06) documented multi-OS variants with video tutorials, countdown timers and malvertising/SEO-poisoning distribution. Malwarebytes (2026-07) documented fake Google/Cloudflare verification pages delivering families such as StealC, HijackLoader and NetSupport RAT. No evidence links the 2026-10-28 infrastructure to those campaigns. BeaconBeagle returned no C2 config or beacon matches for js-static.cfd, and web searches found no other public reporting on these three domains.

Defender focus: the execution step is user-initiated paste-and-run, so detection should centre on clipboard-write behavior from web pages, terminal/PowerShell/Run-dialog child processes of browsers' paste actions, and network requests to the listed domains.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.004 Drive-by Target
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1059.007 JavaScript
- T1036 Masquerading

## Sources

- [Yet Another ClickFix Campaign (SANS ISC diary, Brad Duncan)](https://isc.sans.edu/diary/rss/33466)
- [ClickFix malware attacks evolve with multi-OS support, video tutorials (BleepingComputer)](https://www.bleepingcomputer.com/news/security/clickfix-malware-attacks-evolve-with-multi-os-support-video-tutorials/)
- [Fake Google and Cloudflare verification pages spread multiple malware families (Malwarebytes)](https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families)
- [Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic (SOC Prime / Sekoia)](https://socprime.com/active-threats/iclickfix-wordpress-framework-analysis/)
- [ClickFix: The Attack That Turns Users Into Their Own Attackers (Check Point)](https://blog.checkpoint.com/securing-user-and-access/clickfix-the-attack-that-turns-users-into-their-own-attackers/)
- [ClickFix (Wikipedia)](https://en.wikipedia.org/wiki/ClickFix)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4658