Fake Cloudflare checks lure Windows and Mac users into running commands

Researchers at the SANS Technology Institute's Internet Storm Center identified a campaign using fake Cloudflare verification pages on multiple compromised websites to trick visitors into running malicious commands, Mashable reported. After a visitor clicks the fake verification box, the page claims the check is taking longer than usual and offers instructions to speed it up. The instructions differ for Windows and Mac users. This technique, called ClickFix, relies on users executing commands themselves rather than exploitation of a software or hardware flaw. Legitimate human-verification checks do not require opening a terminal or Windows Run box.