SANS handler Brad Duncan found a ClickFix chain he had not seen before on a legitimate, compromised site. A script from js-static[.]cfd (/embed.js?v=24, then /api/s/* and /api/track/event beacons for geo, IP and timezone) draws a fake Cloudflare verification page that tells the visitor to paste a command.

• macOS command URL: hxxps://cf-id[.]com/?ray-id=nz0ovm2jq2g68i (did not resolve on Oct 28).
• Windows command URL: hxxps://api-com[.]cfd/7ge0w58tzzjsv9 (returned 403 on Oct 28).

The malware itself was not retrieved, so treat these as delivery indicators. Hunt: search proxy and DNS logs for js-static[.]cfd, cf-id[.]com and api-com[.]cfd; on endpoints, look for curl or osascript launched from Terminal right after browser activity on macOS, and powershell, mshta or cmd spawned by explorer.exe via the Run dialog (RunMRU registry entries) on Windows. Duncan notes you can pivot on js-static[.]cfd in URLscan to find other infected sites.