CampaignPublished 28 Oct 2026

Yet Another ClickFix Campaign, (Wed, Oct 28th)

Source SANS ISC Handlers Diary

Description

A ClickFix campaign was observed on October 28, 2026, using a fake Cloudflare verification page to target macOS and Windows users. The campaign attempts to distribute malware but was unsuccessful due to server errors and domain resolution failures. Indicators include multiple URLs from the domain js-static.cfd hosting the fake verification page. No malware samples were obtained, and the campaign's full impact remains unclear.

Impact

The campaign attempts to deliver malware to macOS and Windows users through social engineering involving fake verification pages. However, no successful malware delivery was observed due to server-side access restrictions and domain resolution issues. Therefore, the immediate impact is limited, but the campaign demonstrates ongoing threat actor activity using ClickFix techniques.

Defensive guidance

No active malware distribution was confirmed in this campaign, and no direct remediation actions were reported. Security teams should monitor for similar ClickFix campaigns using fake Cloudflare verification pages and block or investigate traffic to the identified domain js-static.cfd and related URLs. Standard endpoint protection and user awareness against social engineering remain advisable.

Summary

On October 28, 2026, a new ClickFix campaign was detected that impersonates a Cloudflare verification page to trick users on macOS and Windows platforms. The campaign uses the domain js-static.cfd to serve fake verification content and attempts to deliver malware via additional domains, which were either inaccessible or returned errors during analysis. The campaign's infrastructure includes numerous API endpoints for tracking and event logging. Despite these efforts, the malware distribution failed due to 403 Forbidden responses and unresolved domains, preventing further compromise.

References

isc.sans.edu/diary/rss/33466 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 Oct 2026, 16:12 UTC

Technical details

References

Community reviews