A fake Cloudflare verification page asks you to prove you’re human by pasting a command into Windows or your Mac. Don’t. Real Cloudflare checks never ask for that, and running the command can hand an attacker your passwords and files.
Researchers at Cybersecurity News reported a fresh wave on October 29, 2026, built on a trick called ClickFix.
Here are the quick facts:
- The fake page appears on hacked but otherwise normal websites.
- It targets both Windows and macOS visitors with different commands.
- Nothing installs on its own. The danger starts only when you run the command.
- The researcher saw the campaign on October 28, 2026.
The rest of this post shows how the trick works, how to spot it in seconds, and what to do if you already fell for it.
How the fake Cloudflare verification page works
You visit a site you may have used for years. A hidden script, loaded from a lookalike domain, draws a “Verify you are human” box over the page. It copies Cloudflare’s logos and fonts, and it checks your time zone, location and IP address first.
Then comes the ask. The page tells you to open a window and paste a line of text to “finish verification.” That is the whole attack. No software bug is exploited, which is why antivirus and browser updates don’t always stop it.
The steps differ by system, so the page adapts to what you’re using:
| Your system | What the page tells you to do | Why it’s dangerous |
|---|---|---|
| Windows | Open the Run box or PowerShell and paste a command | The command contacts an attacker’s server and can pull down more code |
| macOS | Open Terminal and paste a command | Same idea, different domain. Newer macOS versions may warn you about a suspicious paste |
The point of the table: both versions rely on you doing the final step yourself. That is what lets the attack slip past many built-in protections.
What we know, and what we don’t
Be careful with claims here. In the October sighting, the researcher couldn’t finish either attack chain. The Windows server returned a “403 Forbidden” error, and the macOS domain didn’t resolve. So the final malware for this specific wave is unknown.
The wider ClickFix family is well documented, though. A Malwarebytes report from July 2026 tied similar fake Google and Cloudflare pages to loaders and infostealers such as HijackLoader, StealC and NetSupport, a remote-access tool. These can steal saved passwords or give an attacker remote control.
If that sounds familiar, it’s the same class of threat we covered in our guide to the VOLTA infostealer that grades its victims.
How to spot a fake verification check in 10 seconds
Real verification is a checkbox or a quick background test. It never needs your keyboard. Watch for these warning signs:
- It tells you to press Windows + R, open PowerShell, or open Terminal.
- It has already copied text to your clipboard without you asking.
- It shows a countdown or says your access will be blocked soon.
- The page looks right, but the address bar or the site’s purpose feels off.
Any one of these is enough to close the tab. You lose nothing by leaving, and the site will still be there once its owner cleans it up.
What to do if you already ran the command
Act fast, but stay calm. These steps are general good practice, not a guarantee, so treat them as a starting point.
- Disconnect the device from Wi-Fi or unplug the network cable.
- Run a full scan with a trusted security tool. On Windows, Microsoft Defender’s offline scan is a solid option.
- From a different, clean device, change your important passwords, starting with email, banking and work accounts.
- Turn on two-step verification and sign out of all active sessions where you can.
- If it’s a work computer, tell your IT team right away.
Changing passwords on the infected machine is pointless, because the malware may be watching what you type. For a stubborn infection, a clean reinstall is the safest route. If you use Windows, it also helps to check that built-in protections are on, as in our fix for Smart App Control being grayed out.
For site owners and IT teams
This campaign depends on hacked websites, so site owners are part of the problem and the solution. Check your pages for scripts you don’t recognize, especially ones loaded from odd domains.
Companies can block the Windows Run dialog through group policy and watch for unusual PowerShell or Terminal activity. It’s a small change that shuts down the final step of this attack.
Frequently Asked Questions
Does Cloudflare ever ask me to run a command?
No. A genuine Cloudflare check only asks you to tick a box or wait a moment. If a page asks you to open the Run box, PowerShell or Terminal, it’s fake.
Can I get infected just by seeing the page?
Based on the reports, no. The page is the bait, and the harm starts when you paste and run the command yourself. Closing the tab is enough.
Are Macs safe from this?
No. The October campaign has a separate macOS command. Newer macOS versions can warn about suspicious pastes, but that warning is not something to rely on.
What if I closed the page without running anything?
You’re fine. Nothing installs automatically, so there’s nothing to clean up.
How do I check if a command is safe to run?
If you didn’t ask for it and can’t read what it does, don’t run it. When in doubt, go to the company’s official support page instead of trusting a pop-up.
My take: treat any website that asks you to type or paste something into your system as hostile, however polished it looks. The fix costs you one closed tab, while the mistake can cost you every saved password you have. If you share a computer with family, spend two minutes showing them this one rule today.
Leave a Reply