Fake Cloudflare security verification terminal command scam
Compromised websites are serving fake "verify you're human" and Cloudflare security checks that trick users into pasting malicious commands into their terminal. This scam exploits the clipboard to silently install backdoors and malware on Mac and Windows systems before victims realize it is a trap.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
- 1Users calling IT support instead of executing the script
- 2Educating users on identifying social engineering techniques like ClickFix
- 3Running security tools like BlockBlock or LuLu to alert on new launch agents and outbound connections
- 4Manually checking launch agents, zsh history, and running processes to clean the system
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“Today I had a user call me about this type of scam.”source ↗
“Luckily the end user did not know what the Windows key was and called me.”source ↗
“A real healthcare business's WordPress site served me a fake "verify you're human" check. The command it copied to my clipboard installed a macOS backdoor”source ↗
“the Mac lure is a fake Cloudflare "Performing security verification" page that asks you to press Cmd+Space, open Terminal and paste.”source ↗
Where this came up
People with this problem also raised
- 4Why does IT send fake phishing emails that stress us out?
- 2Why am I getting WhatsApp scams with my real travel booking details?
- 3How to tell if a BEC attack was caught automatically or by a human
- 6Why is security software generating so many false alerts?
- 3Why are spam user registrations automatically approved?
- 7Getting weird scam letters or emails from banks I don't use