SANS Tracks ClickFix Campaign Spoofing Cloudflare Verification

Brad Duncan of the SANS Internet Storm Center reports a new ClickFix campaign observed on 28 October 2026 that spoofs a Cloudflare verification page. The campaign targets both macOS and Windows hosts, but Duncan states he has not yet obtained the distributed malware for either platform. Screenshots show a fake verification flow presented to Windows users, while on macOS the ClickFix command loaded but the domain hosting the malware did not resolve.

In the Windows test, the malware‑hosting server returned a 403 Forbidden response, preventing further progress; in the macOS test, the domain did not resolve when the command was run.

Duncan provides the observed URL chain associated with the domain used to host the fake verification page, identified as js-static[.]cfd. The chain includes multiple endpoints such as embed.js?v=24; API calls under /api/s/ (hit, on, tz, ip, wait, st, track/event); static assets like CF-Logo 1[.]png and fonts/jetbrains-mono-600.woff2; and a dynamic script at c.js with several query parameters including embed, site, parent, path, page_path, and visit_id.

He also notes additional domain names seen in the ClickFix text on macOS and Windows hosts (cf-id[.]com and api-com[.]cfd) and highlights that a domain at js-static[.]cfd is used to generate related traffic. Duncan concludes by pointing to urlscan[.]io for further indicators and clarifies that the diary excludes details on a legitimate compromised site that generated the activity.