Fake Cloudflare CAPTCHA: ClickFix Lures Hide Malware in PNG Images and Lead to Domain Controller Attacks, What Huntress Confirmed and What to Do This Week
Fake Cloudflare "Verify that you are human" checks are getting staff to paste a command that downloads PNG images with whole programs hidden in them. Here is what Huntress confirmed and what businesses should change this week.
Where Worldwide
On this page 9 sections
Criminals are showing office workers fake Cloudflare "Verify that you are human" checks that ask them to paste a command into Windows. Anyone who pastes it lets the attacker into their computer. In cases the security firm Huntress investigated, that one paste led to hidden remote access, password theft and attacks on company domain controllers.
Huntress published the research on Tuesday, November 10, 2026, in a report titled "The Evolving Tradecraft of ClickFix." The newest twist: one campaign downloaded ordinary-looking PNG images with complete Windows programs hidden inside the picture data.
What is a fake Cloudflare CAPTCHA (ClickFix)?
ClickFix is the name researchers give to a trick, not to one piece of malware. A web page shows something familiar, such as a Cloudflare check box. When you click it, the page quietly copies a command to your clipboard. The instructions then tell you to "verify" by opening the Windows Run box or a terminal, pasting and pressing Enter. Because you run the command yourself, many protections that block downloads never get a chance to act.
The real Cloudflare check does not work like this. Cloudflare's Turnstile documentation says it runs small background checks in the browser and, depending on the setting, may show some visitors a checkbox. It does not ask you to type or paste anything into your computer.
How people end up on the fake check
Huntress describes three routes, all taken from real incidents:
- Search ads. A user searched Bing for "Westlaw," the legal research service, and clicked a paid ad. It sent them through a look-alike address ("vvestalw", with two v's in place of the w) to a fake Thomson Reuters site showing the ClickFix check.
- Poisoned search results. People searching for LinkedIn or real estate ended up on spoofed sites with the fake "Verify that you are human" box.
- Hacked legitimate websites. A dental practice's website had been compromised, and its cookie consent pop-up sent visitors to the fake check. Researcher John Hammond found this one.
The dental case had an extra trick. When the page loaded, it quietly saved a file of exactly 17,635 bytes into the browser's cache. The pasted command had separate versions for Firefox, Chrome and Brave. It searched the cache for a file of that exact size, copied it to the Temp folder as a batch file and ran it. To keep the victim calm, a window of fake progress bars turned green as each "check" passed.
The malware hidden inside PNG images
In the image case, the pasted command showed a fake Cloudflare check inside the terminal while dropping a file called verify_pkg.zip into the Temp folder. Inside were three files: a genuine, signed Microsoft program (LockScreenContentServer.exe), a rogue DLL file for that program to load, and a batch file. The batch file started a chain of PowerShell scripts. Those scripts downloaded PNG images, pulled complete programs out of the pixel data, rebuilt them on disk and ran them. A scheduled task and a Run registry key started them again after every reboot.
This matters because an image download looks harmless to many filters. In an earlier case Huntress reported in November 2025, the images held only shellcode, a small piece of code. This time they carried whole programs.
What attackers did after the paste
Huntress says ClickFix is no longer just a way to steal saved browser passwords. In incidents it handled:
| When | What happened after the paste |
|---|---|
| February | Matanbuchus 3.0 loader, then AstarionRAT; the attacker used PsExec to reach a Windows server and two domain controllers |
| May | Potemkin loader, RMMProject and EtherRAT on an unmonitored computer; it spread to 11 machines before it was stopped |
| Early September | cf_verify.zip used a signed program to load a rogue CertEnroll.dll, scanned Active Directory, opened a reverse SSH tunnel, reached the main domain controller and created a new account |
Other cases included DuskDesk, a remote access tool named to look like the legitimate RustDesk, and a lure that started from a ChatGPT custom GPT.
What is confirmed and what is not
Confirmed by Huntress: the lures, the three delivery routes, the file names and the follow-on attacks above, all from incidents its own team investigated.
Who is behind it: Huntress says these newer uses of ClickFix do not appear to be one group's effort. It suggests unconnected threat actors or groups have seen how well ClickFix fools people and are trying their own versions. In practice, that means no single arrest or takedown is likely to make it go away.
Not stated in the report: how many organizations were hit in total, which countries or industries they were in, and the victims' names, including the dental practice. There is also no patch to install. The attack works on people and normal Windows tools, not on a software bug.
What to do this week
| Action | Who | How to check |
|---|---|---|
| Tell every staff member that no real website asks them to paste anything into Run, PowerShell or a terminal | Owner or manager | Send a short note with a screenshot of a fake check |
| Limit the Run box and command prompt for staff who do not need them | Whoever manages your Windows PCs | Press Windows key + R on a standard user account |
| Remove local administrator rights from everyday accounts | IT | Review the local Administrators group on each PC |
| Block programs from running out of Temp and other user-writable folders with application control or allowlisting | IT | Try running a harmless test program from the Temp folder |
| Alert when a browser starts cmd.exe or PowerShell, and on encoded PowerShell | IT or your security provider | Ask your endpoint security vendor whether these rules are on |
| Review new scheduled tasks, Run registry keys and outbound SSH from workstations | IT | Look for names starting CertEnrollCtrl_ or LockScreenContentServer_ |
| Bookmark the real sign-in pages for work tools instead of searching for them | All staff | Legal research, banking, payroll, email |
| If you run a website, check it for pop-ups or scripts you did not add | Website owner | Load the site in a private window and on a phone |
Why it matters for a company network and website
One paste can become a network problem. In the May case, a single unmonitored computer led to 11. In the February and September cases, attackers reached domain controllers, the servers that control every login in a Windows network. Whoever controls those can create accounts, read files and lock everyone else out.
Your website can also be the bait. The dental practice's patients had good reason to trust its site, and that trust is exactly what the attackers used. If your site runs a content management system, plugins or third-party scripts, someone needs to keep them patched and watch for code that was not there yesterday.
Fake Cloudflare CAPTCHA questions people are asking
Is the Cloudflare "Verify you are human" box a virus?
No. The real one is a security check that many websites use. It only becomes dangerous when a fake version asks you to press keys, open Run or paste a command.
How do I tell if a CAPTCHA is fake?
If it asks you to press Windows key + R, open PowerShell or Terminal, or paste anything, it is fake. Close the tab.
I pasted the command. What now?
Disconnect that computer from the network, stop signing in to anything on it and call whoever handles your IT. Change your passwords from a different device you trust.
Can a PNG image infect my computer just by opening it?
Not in this case. The images were downloaded by a script the victim had already run, and that script pulled the hidden programs out. Stopping the paste stops the chain.
Does antivirus stop ClickFix?
You cannot count on it. The victim runs the command themselves, which is why Huntress recommends extra layers, such as alerts when a browser starts PowerShell and blocking programs that run from the Temp folder.
Is there a patch for ClickFix?
No. It is a social engineering trick, so the fixes are staff training, tighter Windows settings and monitoring.
The bigger lesson
The most dangerous step in these attacks is something a person does by hand because a familiar logo told them to. Strong settings help, but the cheapest defense is one rule everyone knows: a website never needs you to paste a command.
To lock down your computers and your website, see security hardening or request a quote.
Get security alerts like this by email, along with our free checklist, at /security-alerts.
Sources: Huntress: The Evolving Tradecraft of ClickFix; Huntress: ClickFix Gets Creative, Malware Buried in Images; Cloudflare Turnstile documentation.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
SAP ICM2SHELL and PROXYGATE: Three CVSS 10.0 No-Login Flaws in the SAP Kernel and Gateway, a Fourth in SAML2, and the Patch Levels to Check
On November 10, 2026, SAP fixed three flaws found by Onapsis that let attackers with no login take over SAP sy...
iPhone Exploit Kits: Leaked DarkSword Code Reached an Employee's iPhone Through an Instagram Ad, and How to Lock Down Work Phones
Criminals are now using leaked iPhone exploit kits built for spies to break into out-of-date iPhones through a...
iOS App Sandbox Bypass: Public worse_query Code Reaches Other Apps' Data on iOS 26 and 27.2, No Apple Fix Confirmed, and What to Do This Week
A developer has published worse_query, proof-of-concept code that lets an iPhone app reach other apps' data on...
