---
title: Hunt: a new ClickFix campaign injects a fake Cloudflare check from js-static[.]cfd into compromised sites and serves separate commands to macOS and Windows visitors | ctxsec
url: https://ctxsec.com/items/hunt-isc-clickfix-js-static-cfd-macos-windows
description: ""
status: "researcher indicators (SANS Internet Storm Center diary, Oct 28); final payloads not retrieved"
published: 2026-10-28
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-isc-clickfix-js-static-cfd-macos-windows.md)

researcher indicators (SANS Internet Storm Center diary, Oct 28); final payloads not retrieved

2026-10-28

### Hunt: a new ClickFix campaign injects a fake Cloudflare check from js-static[.]cfd into compromised sites and serves separate commands to macOS and Windows visitors

SANS handler Brad Duncan found a ClickFix chain he had not seen before on a legitimate, compromised site. A script from `js-static[.]cfd` (`/embed.js?v=24`, then `/api/s/*` and `/api/track/event` beacons for geo, IP and timezone) draws a fake Cloudflare verification page that tells the visitor to paste a command.

- **macOS command URL:** `hxxps://cf-id[.]com/?ray-id=nz0ovm2jq2g68i` (did not resolve on Oct 28).
- **Windows command URL:** `hxxps://api-com[.]cfd/7ge0w58tzzjsv9` (returned 403 on Oct 28).

The malware itself was not retrieved, so treat these as delivery indicators. **Hunt:** search proxy and DNS logs for `js-static[.]cfd`, `cf-id[.]com` and `api-com[.]cfd`; on endpoints, look for `curl` or `osascript` launched from Terminal right after browser activity on macOS, and `powershell`, `mshta` or `cmd` spawned by `explorer.exe` via the Run dialog (RunMRU registry entries) on Windows. Duncan notes you can pivot on `js-static[.]cfd` in URLscan to find other infected sites.

Sources: [SANS ISC diary: Yet Another ClickFix Campaign (Brad Duncan, Oct 28)](https://isc.sans.edu/diary/Yet+Another+ClickFix+Campaign/33466/)