Cloudflare Turnstile clone

Sophos's Counter Threat Unit published this on 11 August 2026 about a campaign it investigated on 3 and 4 June 2026. Script injected into compromised WordPress sites, more than 500 of them, ran environment checks and then showed a Cloudflare-themed prompt asking visitors to run a PowerShell command in Windows Terminal. The command started an MSI whose embedded scripts used winget to install Deno, the legitimate JavaScript runtime, and had it run remote JavaScript from the operators' server. Deno then orchestrated the rest: more PowerShell, reconnaissance, Run-key persistence, and a Python stealer run through pythonw that collects system, browser, extension, wallet and keystroke data. A scheduled task kept Deno fetching fresh script, which on 23 June switched to staging through a TryCloudflare tunnel. Sophos notes that signed Deno builds are less likely to be flagged.

Derp published this analysis on 26 August 2026. A malicious JavaScript action delivered through Cloudflare Zaraz, a legitimate tag-management service, on one victim site loaded the bootstrap of the BW Panel, the back end used by ErrTraffic ClickFix campaigns. The loader asks a Polygon smart contract for the panel's current address, sends it an encrypted request, and is handed one of nine presentation modules: fake browser and font updates, reCAPTCHA and Cloudflare checks for Windows or macOS, a blue screen, a Cloudflare update, or a silent mode. The Windows Cloudflare module places the command on the clipboard, reports whether the copy worked, and polls a token endpoint to follow the victim into the next stage.

CtrlAltIntel published this bulletin on 12 September 2026, following an open directory found through Hunt.io in July 2026 on a server that held a ClickFix kit alongside its payloads. The kit's main script draws a fake Cloudflare checkbox, tries to copy an obfuscated PowerShell command, and a few seconds later tells the visitor to paste it into Windows Run; the command fetches an executable from the same server into the temp folder and starts it. Two other scripts in the set contain errors that leave their delivery unconfirmed. Three droppers built on one Rust framework unwrap to WallStealer, which reads its C2 address from Steam profile names and takes browser passwords, cookies, card data, screenshots and messaging and wallet files, and to an XMRig-based miner reporting to the same server. The bulletin separates the indicators it verified from those it inherited.

Arctic Wolf Labs published this on 24 September 2026 about an ongoing campaign aimed chiefly at Ukrainian users. Hacked websites of real Ukrainian businesses, a hair clinic and a bookseller among them, carry an injected iframe that loads a Ukrainian-language imitation of a Cloudflare check. A click copies an msiexec command, which the visitor is then walked through running from Win+R, so an MSI installs straight from the attackers' domain, registered on 9 September, rather than through the usual PowerShell one-liner. The package fetches a previously unknown stealer Arctic Wolf names Psychedelic after an embedded tag. It takes browser passwords, account tokens and wallet data, plants browser components with a native-messaging bridge, persists through a scheduled task and polls its server for more tasks. An exposed lure panel with Russian branding logged 557 page views from 32 countries, most of them from Ukraine.

Malwarebytes published this on 24 August 2026, following a multi-stage loader it calls PavinLoader from the RenPy fake-game campaigns it had analysed earlier into other operations: ClickFix pages, including a Cloudflare-themed one whose PowerShell fetches an installer from a cloud storage bucket, and fake software downloads served from Dropbox. The routes then converge. Legitimate MSBuild runs project or batch files that load trojanised copies of real .NET libraries, the loader reads its C2 domain from a BNB Smart Chain contract, and later stages arrive as XOR-encoded JSON. It checks for virtual machines and compares the keyboard languages and region against Russian and neighbouring locales. In the chain Malwarebytes followed, the payload was Amatera Stealer. Builder artefacts hint, unconfirmed, that it is sold as a service. The indicator list covers the loader across all these campaigns, not the ClickFix route alone.

Recorded Future's Insikt Group published this on 25 March 2026 as one of five ClickFix clusters, and had reported on the group before. Active since May 2024, the cluster runs its lures on dozens of domains built around the word bird, spoofing Birdeye, an AI marketing company. A visitor to a compromised site is shown a Cloudflare-style check asking for a command in the Windows Run dialog. The command downloads a text payload from a host Insikt links to earlier Lumma Stealer and RedLine delivery, and the browser is then sent to the real Birdeye site so nothing seems amiss. The page script assembles the clipboard command from seven obfuscated lines with the developer's comments left in, one of them in Cyrillic about getting past Cloudflare's static analysis. Insikt names NetSupport RAT as the cluster's payload.

Microsoft Threat Intelligence published this analysis on 28 August 2026 and names the technique TerminalFix: a ClickFix variant that sends the victim to Windows Terminal or PowerShell rather than the Run dialog, where a long multi-line command is likelier to run intact. The lure sits on hacked websites as a counterfeit Cloudflare Turnstile check. While it prints reassuring Cloudflare-styled status lines, the pasted command pulls a ZIP into ProgramData, and inside it a signed Windows lock-screen binary loads a planted dui70.dll. That DLL retrieves PNG images whose pixel data hides a further executable and DLL, adds a Run key and an hourly scheduled task, and enumerates the Active Directory domain. The last stage is a Python implant that relays arbitrary TCP connections over a WebSocket. Microsoft says it did not see what the operators went on to do with that access.

Elastic Security Labs first described this operation, in which a copy-and-paste prompt on compromised websites leads the visitor to run a command that installs a RAT called MIMICRAT. Stormshield found the campaign still running and, on 3 March 2026, pivoted from the two payload servers Elastic had named. Passive DNS on those addresses returned a large estate of look-alike service names - variations on 'avservice', 'msmanager', 'winservice' and similar - spread across the .network, .cc, .lat, .info, .wiki, .live and .pics top-level domains. Almost all were registered through the same registrar, most in early January 2026, and some on the day the report was written. Stormshield notes it expects more to appear. A second pivot, on a 'hosting is blocked' banner returned by one server, produced five further addresses. The report adds thirty-one file hashes, most of them TLS certificates rather than malware.

Three page variants, one codebase. Each reads the user-agent string and hands out a different clipboard payload per platform, and in every case the text on screen is not the text that gets copied. The first serves macOS a Base64-wrapped shell command that fetches Odyssey, and Windows a PowerShell line for a payload Unit 42 could not name. The second targets macOS and gives Windows only a harmless decoy that completes the lure without infecting anything, at times with Cyrillic letters standing in for Latin ones in the domain shown. The third drops the branching and offers the macOS command alone, backgrounded so that closing the window does not stop it. Layout and function naming match across all of them, some carry Russian developer comments left in place, and every C2 traced back to Odyssey, which its operator sells as a service on Exploit and XSS.

Unit 42 found the builder rather than only its output. An open HTTP server on TCP port 3000 ran an Express web application, styled with Tailwind, whose single job was producing counterfeit browser-verification pages. An operator fills in a form: page title, spoofed domain, the wording of the widget, footer and instruction panel, and above all the string that gets placed silently into a visitor's clipboard. Further options cover obfuscation, automatic clipboard-copy injection, a prompt telling phone users to move to a computer, and detection of the visitor's platform so Windows sees one instruction and macOS another. The host was reachable from mid-July 2025 into early October. Unit 42 treats the find as evidence of commoditisation: rival kits competing to package the technique for buyers who lack the skill to write one.

Microsoft takes one landing page apart as a worked example of how such a lure is put together. The visitor meets what appears to be a Cloudflare Turnstile check standing between them and the content. The markup pulls a stylesheet from the Font Awesome library to get the look right, and hides a second document, field.html, inside an invisible frame; that frame draws the tick box and animates a spinner when it is ticked. Ticking it makes the frame post a short message up to the page containing it, and on receiving that message the page writes an obfuscated command into the clipboard through the browser's clipboard interface, then shows the reader the steps for running it. Microsoft dates the page to 22 May 2025 and ties it to no payload family and no actor, so nothing further is claimed here.

Storm-0249, a group Microsoft associates with Latrodectus and other first-stage malware, changed its way in at the start of March 2025. Where it had sent PDFs or links by mail, sometimes themed around copyright complaints, it began taking over legitimate websites — possibly through weaknesses in WordPress — and grafting a lure onto them. A visitor sees the genuine page for a moment before it is swapped for a demand to prove they are human, dressed up as a Cloudflare Turnstile check so the interruption reads as routine. Doing as instructed means pasting a command into the Windows Run dialog. The owners of the hosting sites are victims here, not participants; Microsoft names none of them. The host reached by the pasted command is recorded as cqsf[.]live, seen on 14 May 2025.