**

A familiar security check is being turned into a trap. Security researcher Bradley Duncan, writing for the SANS Internet Storm Center, documented a previously unseen ClickFix campaign on 28 October 2026, with coverage spreading on 29 October. The campaign was spotted during an investigation into a compromised legitimate website, and it used a counterfeit Cloudflare verification page to push visitors towards running commands on their own machines.

The trick works because it borrows trust. Most people have clicked through a genuine "verify you are human" check many times, so a page that looks the same does not immediately raise alarm. In this case, however, the page was not verifying anything at all.

How the trap adapts to each computer

What makes this campaign notable is that it did not use a single script for everyone. Visitors on Windows were shown one set of instructions, while visitors on macOS were shown another, each tailored to that operating system. That adaptation widens the net: the same compromised website could plausibly catch users on either platform, rather than only one.

There is also an important limit to what is known. Duncan was unable to retrieve the intended payload on either system. The Windows delivery server returned a forbidden error, and the domain named in the macOS instructions failed to resolve. The malware family the attackers intended to distribute therefore remains unconfirmed, and no infections have been publicly established from this campaign.

What to do instead of following the prompt

No genuine verification check will ever ask you to open a system tool and run a command it supplies. If a page does so, close the tab, do not paste or run anything, and report the website to your IT team or the site owner. Website owners, meanwhile, should treat an unexpected verification overlay as a possible sign of compromise and check recently changed scripts and third-party content.

Sources: Cybersecurity News; GBHackers.