Malwarebytes warns of fake checks on compromised websites

Malwarebytes’ Pieter Arntz warned on 27 October 2026 that familiar websites can be compromised and used to deliver fake verification pages. In documented campaigns, criminals hacked legitimate WordPress sites and prompted visitors to install malware or run commands disguised as checks, updates or troubleshooting. Requests to open PowerShell to read an article, or to “repair” a computer to watch a video, are examples of suspicious instructions associated with ClickFix attacks.

The warning comes amid several web-security incidents reported in the same week: attackers were exploiting two PHP flaws, researchers disclosed a critical flaw in Brotli software used by Node.js, and eight compromised security certificates raised concerns about how browsers and apps verify websites. Malwarebytes said PHP is used by about seven in 10 websites whose programming language is known, while Node.js is used by 7.4% of sites with identified web-server technology, citing W3Techs. Most browsers had blocked the compromised certificates, but other software and devices might still need updates.

Malwarebytes advised checking whether a page’s request makes sense, even if the site and HTTPS connection are genuine. It recommends keeping operating systems, browsers and applications updated, leaving browser phishing and malware protections enabled, and independently checking requests through official settings or support channels. Browser warnings should not be bypassed, and an unflagged page is not necessarily safe.