SANS ISC discloses a new ClickFix campaign targeting macOS and Windows users

On Oct. 28, 2026, the SANS Internet Storm Center disclosed a new ClickFix campaign that targets macOS and Windows users.

A fake Cloudflare verification page lures users and tricks them into running malicious commands, a tactic that recurs across ClickFix operations. Bradley Duncan of SANS ISC said, “Like several other ClickFix campaigns, this one uses a fake Cloudflare verification page.”

The campaigns have been observed across multiple industries, including technology SaaS providers, financial services firms, and other enterprises.

In the Oct. 28, 2026 campaign, js-static[.]cfd served as the domain behind the fake verification page and its tracking URLs, and the domain appeared in many URLs tied to the phishing activity. Windows users received hxxps[:]//api-com[.]cfd/7ge0w58tzzjsv9, while macOS users received hxxps[:]//cf-id[.]com/?ray-id=nz0ovm2jq2g68i.

The attacks failed on both platforms. When Windows users tried to run the ClickFix command, the server returned a 403 Forbidden error that blocked malware delivery. On macOS, the domain in the command failed to resolve, preventing distribution; the macOS address, cf-id[.]com, did not resolve. A compromised legitimate website generated the ClickFix activity, though SANS ISC did not disclose which site.

Beyond this incident, ClickFix operations send out a PowerShell-based downloader that pulls in a second-stage payload—for example credential stealers, which harvest login names and passwords, or ransomware—with no user interaction needed. PowerShell is a command-line shell and scripting language. A legitimate code-signing certificate signs the first-stage payload, and the digital signature vouches for the software’s publisher, which complicates automated blocking. The payload typically arrives through a malicious link in phishing e-mails.

The campaigns rotate their addresses through fast-flux DNS, a method that rapidly changes the addresses behind a domain, and URL shorteners such as bit.ly and tinyurl, refreshing the infrastructure weekly to avoid takedowns. They aim at technology SaaS providers, financial services firms, and businesses that rely on e-mail for internal communications.

Phishing emails often carry subject lines such as Critical Update – ClickFix and include malicious links pointing to domains such as.clickfix[.]net, and the lures pose as legitimate software updates. The technique uses social engineering instead of exploiting a specific vulnerability, and no CVE – a publicly tracked vulnerability identifier – is tied to it.

Because the method avoids software flaws, traditional security controls can miss the technique. Legitimate-looking verification pages and signed code make the attacks harder to detect, and phishing emails with malicious links serve as the main attack vector.

SANS ISC recommends re-evaluating phishing-simulation cadence and adding ClickFix-style lures to those exercises, plus enforcing multifactor authentication on privileged accounts, measures that are part of its defensive recommendations. Other defenses include URL-reputation filtering, which blocks or flags links based on reputation, sandboxing for inbound links, and the validation of code-signing certificates using an approved list, actions intended to cut the risks that phishing and malware delivery pose.