# New ClickFix Campaign Targets macOS, Windows

Published: 2026-10-28 · Severity: routine
Canonical: https://vorant.io/reports/6ede2837-7110-586b-8d10-2b29cb9cbe92/new-clickfix-campaign-targets-macos-windows
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> SANS ISC documents a new ClickFix campaign using fake Cloudflare verification pages to target both macOS and Windows users.

Source: isc.sans.edu — https://isc.sans.edu/diary/rss/33466

## What to check

- Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

SANS Internet Storm Center handler Brad Duncan reported on a previously unseen ClickFix campaign observed on 2026-10-28. Like other ClickFix campaigns, this one uses a fake Cloudflare human-verification page to social-engineer victims into running a malicious command, targeting both macOS and Windows hosts with platform-specific payloads and instructions. The campaign is delivered via legitimate but compromised websites that load a fake verification overlay from the attacker-controlled domain js-static[.]cfd, which also handles tracking, geolocation, and analytics-style API calls to profile visitors before serving the ClickFix instructions.

The analyst was unable to retrieve the actual malware for either platform: the Windows payload URL (api-com[.]cfd) returned a 403 Forbidden error, and the macOS payload domain (cf-id[.]com) failed to resolve at the time of testing, suggesting the infrastructure may be gated, short-lived, or selectively served. No malware family, actor attribution, or final payload behavior could be confirmed in this instance.

Defenders should treat js-static[.]cfd as the pivot indicator — the analyst notes that searching URLscan for this domain surfaces multiple additional compromised sites generating the same ClickFix activity. Given the cross-platform targeting and reliance on compromised legitimate sites as the initial lure, organizations should monitor for ClickFix-style social engineering (fake CAPTCHA/verification pages instructing users to paste commands into Run dialogs or Terminal) and block known ClickFix-associated domains and infrastructure at the proxy/DNS layer.

## Mentioned in this report

- Campaigns: ClickFix

## Detection guidance (public sample)

### ClickFix - Suspicious Command Stored in Run Dialog History (RunMRU)

ATT&CK: T1204.004

A behavioural hunt for the technique in general. Needs windows registry_set logs. Status: experimental. Generated from the report; not run against telemetry.

A download or execution command appears in the Explorer RunMRU key, indicating a command pasted into the Win+R Run dialog as in ClickFix fake-verification lures. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ClickFix - Suspicious Command Stored in Run Dialog History (RunMRU)
description: Detects download/execution commands written to the Explorer RunMRU registry
  key, which records what a user typed or pasted into the Win+R Run dialog. ClickFix
  fake verification pages instruct victims to paste a script launcher into that dialog.
tags:
- attack.execution
- attack.t1204.004
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains: \Explorer\RunMRU
  selection_bin:
    Details|contains:
    - mshta
    - powershell
    - pwsh
    - curl
    - bitsadmin
    - msiexec
    - wscript
    - cscript
  selection_net:
    Details|contains:
    - http://
    - https://
    - DownloadString
    - iex
    - Invoke-Expression
    - -enc
  condition: selection_key and selection_bin and selection_net
falsepositives:
- Administrators manually running a PowerShell or curl download one-liner from the
  Run dialog
- Helpdesk staff running remote installers via msiexec with a URL
level: medium
id: f162091d-fde0-57ee-9686-098c957836a0
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33466
```

### ClickFix - Script Interpreter With Download Cradle or Fake Verification Text Launched from Explorer

ATT&CK: T1204.004

A behavioural hunt for the technique in general. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Explorer (Run dialog) spawning PowerShell, mshta or cmd with a download cradle or CAPTCHA/verification wording in the command line. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ClickFix - Script Interpreter With Download Cradle or Fake Verification Text
  Launched from Explorer
description: Detects explorer.exe (for example from the Run dialog) launching powershell,
  mshta or cmd with remote download/execute patterns or fake CAPTCHA/verification
  comments, as used by ClickFix pages that tell users to paste a command.
tags:
- attack.execution
- attack.t1204.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \explorer.exe
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \cmd.exe
  selection_cli:
    CommandLine|contains:
    - mshta http
    - mshta.exe http
    - DownloadString(
    - '| iex'
    - '|iex'
    - iex (irm
    - iex(irm
    - I am not a robot
    - Verification ID
    - reCAPTCHA
    - Cloudflare
    - human verification
  condition: all of selection_*
falsepositives:
- Administrators pasting a download-and-execute one-liner into the Run dialog for
  software installation
- Legacy logon or deployment scripts launched from Explorer that use DownloadString
level: high
id: 09bad874-da61-58ec-8931-ad856d5e2f5a
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33466
```

### ClickFix - macOS Shell Decoding Base64 Payload and Piping to Shell

ATT&CK: T1204.004

A behavioural hunt for the technique in general. Needs macos process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

A macOS shell command line that decodes base64 and pipes it into a shell or fetches via curl and pipes to a shell, the typical pasted Terminal command in ClickFix lures. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ClickFix - macOS Shell Decoding Base64 Payload and Piping to Shell
description: Detects macOS shell invocations that base64-decode content and pipe it
  into a shell, or curl and base64 decode combined with a pipe to shell, matching
  commands victims are told to paste into Terminal by ClickFix fake verification pages.
tags:
- attack.execution
- attack.t1204.004
logsource:
  category: process_creation
  product: macos
detection:
  selection_shell:
    Image|endswith:
    - /bash
    - /zsh
    - /sh
  selection_dec:
    CommandLine|contains:
    - base64 -d
    - base64 --decode
    - base64 -D
  selection_pipe:
    CommandLine|contains:
    - '| bash'
    - '| zsh'
    - '| sh'
    - '| /bin/'
  selection_curl:
    CommandLine|contains: curl
  condition: selection_shell and selection_dec and selection_pipe and selection_curl
falsepositives:
- Developers or admin scripts that fetch and decode encoded installer scripts with
  curl
level: high
id: 5dce7abe-55e0-506a-8d9a-b02fea39acd7
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33466
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: an indicator rule with Sigma, Splunk SPL, Elastic, and Suricata. A free account opens it.

Source reporting: https://isc.sans.edu/diary/rss/33466

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6ede2837-7110-586b-8d10-2b29cb9cbe92/new-clickfix-campaign-targets-macos-windows.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the campaigns it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup