TLDR
Attackers are exploiting a Ghost CMS vulnerability (CVE 2026 26980) to hijack more than 700 legitimate education and tech websites, injecting a fake Cloudflare or CAPTCHA verification step that tricks visitors into pasting a Windows...
How it works
Attackers are exploiting a Ghost CMS vulnerability (CVE 2026 26980) to hijack more than 700 legitimate education and tech websites, injecting a fake Cloudflare or CAPTCHA verification step that tricks visitors into pasting a Windows...
Red flags
- : A "verify you are human" or "fix your connection" page that asks you to open Run/PowerShell and paste a command Pressure tactics like countdowns, fake user counters, or urgent messaging pushing you to act fast Even on a trusted domain (university, tech vendor), the page now asks you to execute code locally
What to do
- 1: Never copy paste commands from a webpage into Run, PowerShell, or a terminal
- 2close the tab instead If a site asks you to run code, verify with the site owner's official support channel before doing anything Keep your OS, browser, and anti malware tools up to date, and consider a browser extensio
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/bugs/2026/05/700-education-and-tech-websites-hijacked-in-huge-clickfix-malware-campaignFAQ
Is ClickFix malware hits 700+ trusted sites via fake Cloudflare verification prompt a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: A "verify you are human" or "fix your connection" page that asks you to open Run/PowerShell and paste a command Pressure tactics like countdowns, fake user counters, or urgent messaging pushing you to act fast Even on a trusted domain (university, tech vendor), the page now asks you to execute code locally
What should I do first?
: Never copy paste commands from a webpage into Run, PowerShell, or a terminal; close the tab instead If a site asks you to run code, verify with the site owner's official support channel before doing anything Keep your OS, browser, and anti malware tools up to date, and consider a browser extensio
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.