Hackers Impersonate Cloudflare to Trigger Malicious Terminal Commands

The campaign, documented by the SANS Technology Institute’s Internet Storm Center, leverages a tactic known as ClickFix. When users navigate to a compromised website and click a fake Cloudflare prompt, the interface displays a fraudulent error message claiming the verification process is stalled. The site then instructs the user to run a specific command to resolve the delay, a step that triggers the actual intrusion.

The attack is platform-aware, delivering tailored instructions depending on whether the visitor uses Windows or macOS. These scripts appear designed to harvest sensitive data, including IP addresses and geographic locations, while establishing persistent access for the attackers. Because the process requires no file downloads, it often evades standard antivirus detection. Security experts emphasize that legitimate human-verification tools never require a user to interact with a system terminal or command-line interface to prove their identity.