Beware: Fake Cloudflare verification tricks users into giving hackers access

Cloudflare, a widely utilized service for managing web traffic on numerous websites and online platforms, has become a target for cybercriminals. They are employing new tactics to impersonate Cloudflare, aiming to deceive users into granting hackers unauthorized access to their computers. Cybersecurity researchers have uncovered a novel attack, dubbed "ClickFix," which manipulates Cloudflare's verification pages—a common method employed to confirm that a user is human rather than a bot.

This sophisticated cyber attack preys on social engineering tactics, rather than exploiting any software or hardware vulnerabilities. It does not involve any malicious files that users unwittingly download. Instead, the victim is tricked into copying and executing harmful commands on their own device, which can result in the installation of malware or granting hackers access to the system.

In this particular ClickFix campaign, when users visit a compromised website and see the Cloudflare verification box, they are led to believe the process is taking longer than usual due to a fake verification prompt. To expedite the procedure, they are instructed to follow on-screen directions and execute a specific command. This is precisely when the hacker gains access to the user's device.

Depending on whether the user accesses the website through a Windows PC or a Mac, different commands are displayed to the victim. The report highlights these instructions, which may seem to be tracking information, such as the visitor's location and IP address. The attack has been observed on multiple compromised websites.

To avoid falling victim to this type of cyber attack, users should be aware of the standard verification methods, such as clicking verification boxes or completing CAPTCHAs. Importantly, users should never open their terminal or Run box to complete a human-verification check.