Hackers impersonate Cloudflare verification pages in ClickFix attack

Cybersecurity researchers have uncovered a new social engineering attack that mimics Cloudflare’s verification pages to deceive users into executing malicious commands. The attack, identified by the SANS Technology Institute’s Internet Storm Center, highlights the growing sophistication of tactics that exploit trust in widely used internet infrastructure.

Tarun Mottlia

Editor, Lazyfounder

Published Nov 3, 20262 min read

Hackers impersonate Cloudflare verification pages in ClickFix attack — Image: Mashable via source

KEY HIGHLIGHTS

Hackers are impersonating Cloudflare’s verification pages in a social engineering attack discovered by researchers at the SANS Technology Institute’s Internet Storm Center.
The attack, dubbed ClickFix, tricks users into copying and executing malicious commands on their devices via fake verification prompts.
Instructions differ for Windows and Mac users, and the attack has been deployed across multiple compromised websites.
The fake verification process may track user location and IP addresses.

How the ClickFix attack works

The attack, dubbed ClickFix, leverages fake Cloudflare verification prompts on compromised websites. When users encounter these prompts, they are instructed to copy and run commands to "speed up" the verification process. The instructions vary depending on whether the user is on a Windows PC or a Mac.

Researchers at the SANS Technology Institute’s Internet Storm Center discovered that the fake verification process may also collect user data, including location and IP addresses. Unlike traditional exploits, ClickFix relies entirely on social engineering, bypassing the need for software or hardware vulnerabilities.

Scope and method of the attack

The attack has been deployed across multiple compromised websites, suggesting a coordinated effort to maximize reach. Victims are tricked into opening their terminal or Run box, where executing the provided commands grants hackers access to their devices.

The SANS Technology Institute’s Internet Storm Center warns that legitimate human-verification checks never require users to run commands in a terminal or Run box. The attack’s effectiveness lies in its exploitation of Cloudflare’s ubiquitous presence, which lulls users into a false sense of security.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This attack is a reminder that even infrastructure as trusted as Cloudflare can be weaponized against users. For founders and operators, the incident is a signal to revisit how verification flows are designed and communicated—particularly when they involve unfamiliar technical actions like command-line execution. The reliance on social engineering also underscores the limits of purely technical defenses; user awareness and clear messaging are critical to mitigating such risks.

Key takeaways

Founders and operators should audit third-party verification flows embedded in their products; attackers are now mimicking trusted infrastructure like Cloudflare.
Security teams must prioritize user education about social engineering tactics, particularly those involving command-line execution under the guise of verification.
This incident underscores the risk of relying on familiar brand names (e.g., Cloudflare) to legitimize technical actions—even tech-savvy users can be deceived.

Sources

Mashable · 2026-11-02
Beware: Fake Cloudflare verification tricks users into giving hackers access

This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.

About the author