NewsHive
CONTACT USANALYST PORTAL →
securityBACKGROUND

Fake Google and Cloudflare verification pages spread multiple malware families

BACKGROUND
1 SIGNALFIRST DETECTED 2 July 2026
Narrative synthesis pending — 1 signal collected.
How the story developed
Other feeds and industry voices
5 Aug
Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat

REPORT · WHAT · The Hacker NewsOPEN STORY
1 Jul
Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery

ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human"

REPORT · WHO · The Hacker NewsOPEN STORY
26 May
700+ education and tech websites hijacked in huge ClickFix malware campaign

Hackers are abusing a Ghost CMS website flaw to serve fake Cloudflare verification pages that pressure users into infecting their own PCs.

REPORT · WHAT · Malwarebytes LabsOPEN STORY
24 Sept
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer

An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading

REPORT · WHEN · The Hacker NewsOPEN STORY
30 Aug
TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor

Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While

REPORT · WHAT · The Hacker NewsOPEN STORY
16 Jun
ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, per independent

REPORT · WHAT · The Hacker NewsOPEN STORY
Sources
Malwarebytes Labs

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →