Over 13,000 unique domains use Cloudflare for Clickfix attacks

In mid-2025, Lab539 researchers noticed an unexpected increase in a new browser-based malware campaign known as ' ClickFix '. Appearing quietly in July, the threat quickly expanded to include over 13,000 unique domains designed to trick users into executing malicious commands on their devices.

See also: New Phishing Kit automates the ClickFix attack process

The attack leverages compromised or low-cost hosting infrastructure, including a major part behind Cloudflare, to deliver malicious payloads via deceptively innocent web prompts. Users who encounter these sites first encounter a CAPTCHA before being instructed to execute a command from their clipboard, giving attackers the ability to deploy arbitrary scripts or executables.

Initially, the volume of ClickFix domains seemed insignificant amidst the vast sea of ​​adversarial activity. However, by mid-August, a notable increase had raised alarms across multiple threat intelligence platforms. Lab539 analysts noted the sudden proliferation of websites promoting malware delivery under the guise of ‘verification’ steps, a characteristic that distinguishes ClickFix from more traditional phishing or watering-hole attacks.

The scale of domain registration suggested an automated delivery pipeline, likely powered by pay-per-use registrar services and reseller hosting, rather than the manual installation preferred by advanced persistent malicious actors. Despite Cloudflare’s dominance among hosting providers, accounting for approximately 24% of ClickFix domains observed, the campaign’s long list of nearly 500 other providers reveals a strategic use of diverse infrastructure to evade simple block lists.

See also: Lazarus APT uses ClickFix technique to steal data

Regional VPS services in the United States, Germany, Indonesia, and Brazil are prominent, reflecting both global distribution and opportunistic third-party server compromise. In many cases, attackers are reusing old or misconfigured subdomains—such as decades-old academic or municipal servers—to mix malicious traffic with legitimate DNS records.

The basic infection mechanism relies on leveraging the browser clipboard API to plant a command that the user unknowingly pastes into a terminal. Once the CAPTCHA is completed, the website writes a sequence of PowerShell commands to the clipboard. This single line downloads and executes a VBScript without further user interaction, exemplifying the campaign’s emphasis on social engineering over the exploit chain.

See also: New ClickFix attack imitates AnyDesk and distributes MetaStealer

Variants include direct executable downloads and covert scripts, indicating multiple operators using the ClickFix framework. The ubiquity of this mechanism highlights how minimal technical complexity can still yield large-scale intrusion opportunities when combined with automated domain registration and global hosting assets.