ClickFix Attack Uses Fake Cloudflare Verification to Silently Deploy Malware

A newly identified social engineering attack dubbed “ClickFix” has emerged as a significant threat, leveraging meticulously crafted fake Cloudflare verification pages to trick users into executing malicious code on their devices.

This phishing tactic, disguised as a routine security check, exploits the familiarity of Cloudflare’s Turnstile CAPTCHA interface to deceive users into running hidden PowerShell commands.

By mimicking the legitimate “Verify you are human” prompt, complete with official branding and dynamically generated Ray IDs, ClickFix lulls victims into a false sense of security while orchestrating a silent malware deployment.

Deceptive CAPTCHA Interface Exploits User Trust

The attack’s simplicity, combined with its ability to bypass traditional security filters, makes it a potent tool for cybercriminals aiming to deliver payloads ranging from info-stealers like Lumma to remote access trojans such as NetSupport Manager.

The ClickFix attack unfolds with alarming precision, beginning when a user encounters a malicious or compromised website hosting the fake Cloudflare page.

The HTML-based phishing interface, often obfuscated to conceal its malicious intent, replicates the Turnstile design down to the smallest detail, embedding all resources locally to avoid detection.

Upon interaction with the “Verify you are human” checkbox, a hidden script leverages web APIs to copy an obfuscated PowerShell command often Base64-encoded directly to the user’s clipboard without any visible indication.

The page then displays deceptive instructions, prompting the user to press Win+R to open the Windows Run dialog, paste the clipboard content with Ctrl+V, and execute it by hitting Enter.

Unbeknownst to the victim, this sequence runs a malicious one-liner that can download and execute secondary malware payloads in memory, evading antivirus scrutiny since no traditional executable file is directly involved.

According to the SlashNext Report, this technique’s reliance on legitimate system utilities like powershell.exe or mshta.exe further complicates detection by endpoint protection systems, allowing attackers to retrieve and deploy threats seamlessly.

Command Execution

The effectiveness of ClickFix lies in its exploitation of human behavior and trust in familiar web security mechanisms.

Internet users, conditioned by frequent CAPTCHA prompts and verification steps, often rush through such processes without scrutinizing the details, a phenomenon dubbed “verification fatigue.”

The pixel-perfect replication of Cloudflare’s interface, coupled with convincing domain names or compromised legitimate sites, reinforces the illusion of authenticity.

Even subtle indicators like the presence of a padlock icon or the absence of overt download prompts can mislead users into complying with the attack’s instructions, transforming a seemingly benign action into a gateway for malware installation.

Moreover, the attack’s delivery through typosquatted or hacked URLs undermines conventional advice to check the address bar, as the malicious page may appear tied to a trusted or recognizable domain.

As ClickFix continues to evolve, its low-tech yet highly persuasive approach poses a growing challenge to web security.

Traditional filters struggle to keep pace with such socially engineered threats that rely on user interaction rather than exploitable vulnerabilities.

Advanced defenses, such as AI-powered solutions from providers like SlashNext, offer a potential countermeasure by detecting fake verification prompts and hidden clipboard injections in real time, blocking the attack before users can execute the fatal command sequence.

For now, user awareness and vigilance remain critical to mitigating the risks posed by this insidious phishing technique, underscoring the need for education on recognizing unusual verification steps even on seemingly legitimate pages.