ClickFix demo
Educational Demo - Fake Cloudflare ClickFix Attack
This demonstrates how attackers mimic legitimate Cloudflare verification pages. This is a safe demo with no malware.
Fake Cloudflare "Verify You Are Human" Attack
One of the most convincing ClickFix variants mimics the familiar Cloudflare verification page that millions of users see daily. Because people trust Cloudflare's security checks, they're more likely to follow malicious instructions.
Why This Works:
- Familiarity: Users see real Cloudflare pages regularly and trust them
- Legitimacy: The design perfectly mimics real Cloudflare branding
- Expectation: Verification checks are normal, so users don't question them
- Authority: Cloudflare is a trusted security company
Checking your browser
example-site.com
This process is automatic. Your browser will redirect to your requested content shortly.
⚠️ Malicious code has been copied to your clipboard!
In a real attack, pressing Win+R and pasting would execute malware. Let's see what happens next in this safe demo.
⚠️ Command Copied!
The malicious PowerShell command is now in your clipboard.
Try the Safe Demo:
Experience what victims go through (safely):
- 1 Press Windows + R to open Run dialog
- 2 Press Ctrl + V to paste
- 3 Press Enter to execute
✓ This is completely safe!
The command will open an educational page. No malware will be installed.
How to Spot Fake Cloudflare Pages
Legitimate Cloudflare
- Shows "Checking your browser" message
- Automatic verification (5-10 seconds)
- May show simple checkbox
- Never asks for commands
- No copy/paste instructions
- Stays in browser window
- Completes automatically
Fake ClickFix Attack
- Asks to press Windows+R
- Instructions to paste commands
- Says "code copied to clipboard"
- Requests you run PowerShell
- May have urgency/warnings
- Doesn't complete automatically
- Requires your action to "verify"
🚨 Critical Red Flags
If you see ANY of these, it's a fake:
- Any instruction to press Win+R, open Terminal, or use PowerShell
- Messages about "code copied to clipboard" or "paste the verification code"
- Instructions to run commands to complete verification
- Pop-ups or dialogs asking you to execute anything
- Verification that doesn't complete automatically after a few seconds
🛡️ Protection Tips
- Remember: Real Cloudflare checks are automatic - you just wait
- Never run commands from websites, even if they look legitimate
- Check the URL - fake pages may have suspicious domains
- When in doubt, close the page and access the site directly
- Report suspicious pages to your IT department or security team
- Educate others - share this knowledge with colleagues and family
Why This Attack is So Effective
Attackers specifically chose to mimic Cloudflare because:
- Ubiquity: Millions of websites use Cloudflare, so users see these pages daily
- Trust: Cloudflare is a legitimate security company, lending credibility
- Familiarity: Users are conditioned to expect and pass these checks
- Confusion: The fake page looks nearly identical to the real one
- Autopilot: People don't scrutinize familiar security checks carefully
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!