ClickFix Is Back: Fake Cloudflare Pages Now Target macOS and Windows in 2026's Fastest-Growing Social Engineering Campaign
Executive Summary
In late October 2026, a newly identified ClickFix social engineering campaign was observed targeting both macOS and Windows users via a fake Cloudflare verification page hosted on the domain js-static[.]cfd. The attack chain lures victims into manually executing a malicious command copied from the spoofed page, a hallmark of ClickFix-style delivery. The campaign fingerprints the victim's OS and serves platform-specific payloads. Although the final-stage malware was not retrieved due to infrastructure errors (403 Forbidden on Windows and DNS non-resolution on macOS), the staging infrastructure and URL chain were fully documented, revealing a multi-step victim-profiling and geo-tracking mechanism prior to payload delivery.
ClickFix campaigns are accelerating in 2026, with threat actors increasingly abusing trusted brand impersonation—particularly Cloudflare—to bypass user skepticism. The manual-execution lure circumvents many automated endpoint defenses, making user-targeted social engineering one of the fastest-growing initial access vectors across enterprise and SMB environments alike.
Why This Matters Now
ClickFix attacks are surging because they bypass traditional endpoint controls by tricking users into self-executing malicious commands—no exploit required. With Cloudflare impersonation now a common lure template and campaigns targeting both macOS and Windows simultaneously, organizations face elevated risk at the human layer precisely when AI-assisted phishing is making social engineering harder to detect.
Attack Path Analysis
Attackers compromised a legitimate website to serve a fake Cloudflare verification page using the ClickFix social engineering technique, tricking users into manually executing a malicious command on their host. The campaign targeted both macOS and Windows systems and relied on attacker-controlled infrastructure (js-static[.]cfd, cf-id[.]com, api-com[.]cfd) to deliver OS-specific payloads; although the malware stage was disrupted (403 errors and DNS non-resolution) during observation, the delivery chain was fully operative and designed to install persistent malware enabling command-and-control, lateral movement, and eventual data exfiltration.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
A legitimate but compromised website was weaponized to inject a fake Cloudflare CAPTCHA/verification page hosted via js-static[.]cfd. Visitors were socially engineered via ClickFix instructions to open their OS clipboard-loaded command (PowerShell on Windows, Terminal on macOS) and execute a malicious payload fetched from attacker-controlled domains. This technique abuses user trust in Cloudflare branding and bypasses automated browser defenses by requiring manual execution.
MITRE ATT&CK® Techniques
Phishing: Spearphishing Link
User Execution: Malicious File
User Execution: Malicious Link
Masquerading: Match Legitimate Name or Location
Command and Scripting Interpreter
Application Layer Protocol: Web Protocols
Stage Capabilities: Drive-by Target
Drive-by Compromise
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Malicious Code Protection
Control ID: SI-3
CISA Zero Trust Maturity Model 2.0 – Application-Level Threat Visibility
Control ID: Application Pillar – Visibility and Analytics
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21 – Security of Network and Information Systems
PCI DSS 4.0 – Protection Against Phishing Attacks
Control ID: Requirement 5.4.1
NYDFS 23 NYCRR 500 – Cybersecurity Awareness Training
Control ID: Section 500.14(a)
DORA (Digital Operational Resilience Act) – Security Awareness and User Endpoint Controls
Control ID: Article 13 – ICT Security Policies, Procedures and Tools
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
ClickFix social engineering campaigns targeting IT environments exploit fake Cloudflare verification pages, enabling malware delivery across Windows and macOS endpoints, risking lateral movement and data exfiltration per NIST.800-53.SC-7 controls.
Financial Services
ClickFix malware delivery via compromised legitimate sites threatens financial sector endpoints, with egress policy gaps and undetected C2 channels risking PCI.4.0 compliance violations and unauthorized data exfiltration of sensitive financial records.
Health Care / Life Sciences
Social engineering ClickFix campaigns targeting healthcare workers via fake verification pages risk HIPAA.164.312(e)(1) violations through unencrypted exfiltration and lateral movement across clinical workloads containing protected health information.
Government Administration
Cross-platform ClickFix campaigns impersonating trusted services like Cloudflare pose significant risk to government endpoints, threatening ZTMM compliance, enabling privilege escalation, and facilitating covert C2 channels across sensitive administrative networks.
Sources
- Yet Another ClickFix Campaign, (Wed, Oct 28th)https://isc.sans.edu/diary/rss/33466Verified
- CISA Advisory: Threat Actors Leverage ClickFix Social Engineering Technique in Multiple Campaignshttps://www.cisa.gov/news-events/cybersecurity-advisories/aa25-093aVerified
- ClickFix: How to Infect Your PC in Three Easy Steps - Krebs on Securityhttps://krebsonsecurity.com/2024/09/clickfix-how-to-infect-your-pc-in-three-easy-steps/Verified
- Fake Cloudflare Verification Pages Delivering RATs and Info-Stealers - Proofpoint Threat Researchhttps://www.proofpoint.com/us/blog/threat-insight/clipboard-hijacking-and-clickfix-campaignsVerified
- ClickFix Campaigns: A Growing Social Engineering Threat - Trend Microhttps://www.trendmicro.com/en_us/research/24/l/clickfix-campaigns.htmlVerified
- URLScan.io Search for js-static[.]cfdhttps://urlscan.io/search/#page.domain%3Ajs-static.cfdVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant because this campaign relies on attacker-controlled external infrastructure for payload delivery, persistent C2, and credential exfiltration — all of which traverse cloud egress paths that identity-aware segmentation and controlled egress policies would likely constrain. By enforcing workload-level isolation and restricting outbound reachability to known-good destinations, Aviatrix could meaningfully reduce the blast radius of a compromised endpoint reaching internal cloud resources.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Outbound connections from workloads or managed endpoints to unrecognized attacker-controlled domains like js-static[.]cfd and api-com[.]cfd would likely be constrained by fabric-level egress policy, reducing the reachability of payload staging infrastructure from within the cloud environment.
Control: Zero Trust Segmentation
Mitigation: Even if privilege escalation succeeds on an endpoint, Zero Trust segmentation would likely constrain what elevated workload identities can reach within the cloud environment, reducing the scope of access available to a newly privileged process or compromised identity.
Control: East-West Traffic Security
Mitigation: East-west enforcement would likely reduce the reachability of compromised endpoints attempting to pivot toward internal workloads using harvested credentials, constraining how freely stolen session tokens or SSH keys could be replayed across segmented cloud boundaries.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility into outbound traffic patterns from cloud workloads would likely surface anomalous HTTPS callback behavior to unrecognized CDN-mimicking domains, reducing attacker dwell time by making persistent C2 sessions more detectable and constraining their continuity across cloud environments.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement applied at the workload boundary would likely constrain outbound HTTPS data flows destined for attacker-registered domains, reducing the reachability of exfiltration endpoints even when traffic attempts to blend with legitimate CDN-bound activity.
With segmentation, controlled egress, and east-west enforcement applied across prior stages, the attacker's ability to convert harvested credentials into broad cloud access would likely be reduced — limiting account takeover scope to identities not yet constrained by workload-level policy boundaries.
Impact at a Glance
Affected Business Functions
- End-User Workstation Security (Windows and macOS endpoint integrity)
- Credential and Identity Management (risk of credential harvesting via delivered malware)
- Web Browsing and Internet-Facing Services (compromised third-party website as initial access vector)
- Security Awareness and Incident Response Operations
Estimated downtime: 1 days
Estimated loss: N/A
The malware payload was not successfully retrieved during analysis due to a 403 Forbidden response on Windows and an unresolvable domain on macOS at the time of observation. However, based on the ClickFix campaign pattern and its known payload types (remote access trojans, information stealers, and clipboard hijackers), categories of data at risk on successfully compromised hosts would include: browser-stored credentials, session cookies, cryptocurrency wallet data, system reconnaissance data, and potentially corporate VPN or SaaS application credentials. No confirmed data exfiltration was observed in this specific campaign instance. Financial loss is recorded as $0 due to payload delivery failure during analysis, but real-world victims who executed the ClickFix command successfully may face significant credential exposure and downstream account compromise costs.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement (CNSF): Implement FQDN-based egress filtering to block outbound HTTPS connections to uncategorized or newly registered domains such as js-static[.]cfd, cf-id[.]com, and api-com[.]cfd. Egress controls with application-layer awareness would have severed C2 communication and payload delivery before malware could establish persistence, directly addressing the ZTMM.Data and NIST.800-53.SC-18 compliance gaps.
- • Enable Cloud Firewall (ACF) with AI-Driven Traffic Discovery: Apply outbound firewall policies with URL/FQDN filtering to detect and block traffic to attacker infrastructure masquerading as CDN endpoints. AI-assisted discovery of anomalous outbound traffic patterns — such as repeated hits to /api/s/ip, /api/s/geo, and /api/s/wait endpoints — would surface ClickFix C2 beacon behavior consistent with NIST.CSF.DE.CM-8 detection objectives.
- • Activate Inline IPS (Suricata) for Malware Delivery Signature Coverage: Deploy inline intrusion prevention with up-to-date signatures covering ClickFix payload delivery patterns, PowerShell-based malware staging, and known malicious payload hashes. Inline IPS inspection on outbound and inbound HTTP/S flows would catch known-bad payload signatures at the point of delivery, aligning with PCI.4.0.6.4.1 and NIST.800-53.SI-4 requirements.
- • Enforce Zero Trust Segmentation to Limit Post-Compromise Lateral Movement: Apply identity-based microsegmentation policies ensuring that any endpoint executing a ClickFix payload cannot directly reach cloud workloads, internal APIs, or sensitive data stores. Least-privilege workload-to-workload policies aligned with ZTMM.Network and NIST.800-53.AC-6 would contain lateral movement even if initial compromise occurs.
- • Leverage Multicloud Visibility & Control for C2 Behavioral Anomaly Detection: Instrument centralized traffic observability across cloud and hybrid environments to baseline normal outbound connection patterns and alert on anomalous interaction sequences — such as rapid sequential API calls to geolocation, IP-lookup, and tracking endpoints characteristic of ClickFix staging infrastructure. This addresses ZTMM.CrossCutting.Visibility and NIST.800-53.AU-6 audit and detection requirements.
