VULNpocalypse
MediumEcosystem changeMonitoring

SANS ISC reports new ClickFix campaign using fake Cloudflare check

SANS ISC reports a ClickFix campaign using a fake Cloudflare check; block the listed domains and do not run commands a web page tells you to.

Published
Exploitation
Not confirmed, SANS ISC says the macOS and Windows payload servers did not deliver malware during its test

What happened

According to a SANS ISC diary by Brad Duncan, published 2026-10-28, he found a ClickFix campaign he had not seen before. SANS ISC reports that the campaign shows a fake Cloudflare verification page and targets both macOS and Windows.

SANS ISC says the fake page was triggered by a legitimate but compromised website. The diary removed the name of that site. According to the diary, the page loads from the domain js-static[.]cfd, which serves a script (embed.js) and a series of tracking and API requests before showing the ClickFix instructions.

SANS ISC reports that the instructions differ by operating system:

  • On macOS, the command pointed to cf-id[.]com. The domain did not resolve on 2026-10-28.
  • On Windows, the command pointed to api-com[.]cfd. The server returned a 403 Forbidden response on 2026-10-28.

The author says he was unable to get the macOS or Windows malware from this campaign. The diary does not give a name for the activity.

Not confirmed:

  • What malware the campaign delivers.
  • Who runs it.
  • How the hosting sites were compromised.
  • How many sites or users are affected.

There is no independent verification beyond the SANS ISC diary.

Am I affected?

You may be exposed if any of the following apply. The domains come from the SANS ISC indicators.

  • Browser or proxy logs show requests to js-static[.]cfd, for example /embed.js or /api/s/ paths.
  • DNS or proxy logs show lookups or requests to cf-id[.]com or api-com[.]cfd.
  • A user reports a Cloudflare-style “verification” page that asked them to copy and run a command.

If you run a website, check whether your pages load a script from js-static[.]cfd. SANS ISC says the fake page came from a compromised legitimate site. It also notes that pivoting on js-static[.]cfd in URLscan finds several sites likely to generate this traffic.

What to do now

  1. Block js-static[.]cfd, cf-id[.]com and api-com[.]cfd at DNS, proxy or firewall level. These are the domains listed by SANS ISC.
  2. Search browser, proxy and DNS logs for these domains. For any host that reached cf-id[.]com or api-com[.]cfd, find out whether a user ran a command on it.
  3. Site owners: look for unexpected script tags referencing js-static[.]cfd in your pages and templates. If you find one, treat the site as compromised. The entry point is not confirmed by the source.
  4. General practice, not from the source: remind users that a real browser check never asks them to paste and run a command in a terminal or the Run dialog.

Sources