conv.

All stories
SecurityQuiet 9d · day 10

Hackers impersonate Cloudflare verification to trick users into executing malware

A ClickFix campaign uses fake verification pages to social-engineer Windows and Mac users into running malicious commands.

newest coverage 8d agosummary written 8d ago4 pieces RedditNewswiresGoogle News

What to know

  • Hackers are impersonating Cloudflare's verification pages on compromised websites to trick users into running malicious commands.
  • The ClickFix campaign exploits trust in Cloudflare's ubiquity; it uses social engineering rather than software vulnerabilities.
  • Different payloads target Windows and Mac systems and track user location and IP address; users should never open a terminal to verify they are human.

“ClickFix campaigns are cyber attacks that rely on social engineering tactics. There are no software or hardware security flaws involved.”

Mashable · Mashable ↗ · Nov 1

SANS Technology Institute's Internet Storm Center Cybersecurity researchersCloudflare Company whose verification pages are being impersonated

Hackers impersonate Cloudflare verification to trick users into executing malware
Mashable

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 3 pieces in 3h at Nov 2, 12 PM; 4 pieces over 10 days (3 articles · 1 post) Nov 1, 3 PM — 1 piece · 1 post — Reddit 1Nov 1, 6 PM — quietNov 1, 9 PM — quietNov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — quietNov 2, 12 PM — 3 pieces · 3 articles — Google News 2, Newswires 1Nov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quiet 12
Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9now · 5:43 AM ET
  1. 2

    Hackers customize payloads by OS; requests track location and IP address

    Different instructions appear depending on whether the victim uses Windows or Mac. The malicious commands reportedly include requests intended to track information such as visitor location and IP address. The attack has been rolled out across multiple compromised websites.

    “Hackers are now tricking internet users with fake Cloudflare verification pages.”
    — Mashable · source
  2. background

    Attack mechanics: fake pages prompt users to execute malicious commands — The attack works by directing users to compromised websites where a fake Cloudflare verification box appears. After clicking it, users are told verification is taking longer than usual and are prompted to follow on-screen instructions to run a command—actually a payload that grants hackers access or downloads malware.

  3. 1

    SANS researchers discover ClickFix campaign using fake Cloudflare verification

    Cybersecurity researchers at SANS Technology Institute's Internet Storm Center identified a new attack that weaponizes fake Cloudflare verification pages to trick users. The campaign exploits the ubiquity of Cloudflare's services by impersonating its human-verification prompts on compromised websites.

    1. 2 outlets Hackers Use Fake Cloudflare Verification Pages to Target Windows and Mac Users

      first by CyberSecurityNews, 8d ago · also Mashable

      1 more headline