ClickFix: fake Cloudflare check branded as an AI or crypto service (Win+R / Terminal) — page code

Throwaway lookalike domains (claudedevz[.]net, openai-credit[.]com, googlegeminidev[.]com, higgsflield[.]net, strategyvote[.]com and others) that serve a fake Cloudflare 'Performing security verification' page showing the name and icon of a well-known AI service or crypto brand (Claude, OpenAI, Gemini, Higgsfield, Strategy, Robinhood, OKX). The page copies a command to the clipboard and tells the visitor to paste it into the Windows Run dialog (Windows key + R, Ctrl+V, Enter) or into Terminal on macOS. On Windows the command is obfuscated PowerShell that downloads a ZIP containing a trojanized GitHub Desktop (a backdoored resources/app/main.js) and starts it from a scheduled task; on macOS it pipes a downloaded script into zsh or bash. The lures promise free API credits or bonuses. Seen since July 2026; the download servers change every few weeks while the page stays the same. No legitimate verification step asks visitors to run a command.