WORLDTECHFake Cloudflare Checks on Hacked Sites Target Windows and Mac Users
Attackers are abusing compromised websites to show counterfeit Cloudflare verification pages that push Windows and macOS users toward running harmful commands, GBHackers reports. The evidence points to an attempted delivery rather than a confirmed infection.
What the researcher saw
In place of a genuine check, visitors to the affected pages receive directions aimed at moving execution from the browser onto their own computers. The scheme depends on how familiar browser security checks look, which lets the lure pass as routine.
A researcher identified only as Duncan found that the directions changed depending on whether the lure was viewed from a Windows or a macOS host, suggesting the campaign accommodates both operating systems. Duncan has withheld the identity of the legitimate site whose compromise first drew his attention.
Test halted before any payload
When Duncan ran the command in his test environment, the hosting server answered with an HTTP 403 Forbidden response, which stopped further analysis of the intended delivery chain. A domain also would not resolve during testing, ending the investigation again before any payload could be fetched.
According to the report, neither failure proves the campaign is harmless or permanently dormant. They describe how the infrastructure behaved during the researcher's observations, and the malware it was meant to deliver remains unidentified.
A technique that relies on the user
The approach is a variant of ClickFix, a method that induces users to perform the risky step themselves. Microsoft characterises it as showing an apparent problem or verification requirement and then telling victims to run attacker-supplied commands.
The report observes that Windows campaigns often use the Run dialog, while macOS variants can direct users to execute commands in Terminal. These are traits of the wider technique and have not been independently confirmed as the exact commands in Duncan's campaign.
Why the observation matters for defenders
The SANS Internet Storm Center documented the previously unnamed campaign on October 28, 2026, but could not retrieve the intended payload for either platform. The findings therefore call for investigation in context rather than an automatic assumption that malware ran successfully.
The report says the lure gives defenders a useful indicator to hunt for when reviewing browser histories, proxy telemetry or unexpected external scripts loaded by websites.
Open questions
- How many websites have been compromised to host the fake verification pages?
- Which malware, if any, was the campaign built to deliver to Windows and macOS users?