Fake Cloudflare checks conceal malware within PNG images

Cybercriminals are exploiting counterfeit Cloudflare verification pages to install malware concealed inside PNG images, extending the ClickFix attack technique beyond conventional malicious scripts and credential-stealing downloads.

Cybersecurity company Huntress has documented attacks in which victims are persuaded to execute commands after encountering apparently routine human-verification checks. Investigators identified an infection chain that retrieves image files containing concealed executable code, extracts the payload and establishes unauthorised access to affected Windows computers.

The technique combines deceptive search results, compromised websites and legitimate Windows utilities with steganography, which hides information inside ordinary-looking digital images. Its effectiveness depends on persuading users to perform actions that a genuine browser verification service would never require.

One incident investigated by Huntress began when a user searched Bing for Westlaw, the legal research platform operated by Thomson Reuters, and selected a sponsored result. The advertisement redirected the visitor through a lookalike address to a counterfeit Westlaw sign-in website displaying a ClickFix prompt.

The fraudulent page imitated a security check rather than presenting an obvious software download. Such prompts typically instruct visitors to open the Windows Run dialogue and paste clipboard contents, falsely describing the operation as necessary to prove they are human.

Huntress also identified a separate infection sequence in which a batch file launched a multistage PowerShell process. The script downloaded PNG images containing executable binaries concealed within pixel data. It then reconstructed the malicious files and executed them on the victim’s machine.

Investigators found that the resulting malware established persistence through a scheduled task and a Windows registry Run key. Those mechanisms can allow malicious processes to resume after a computer restarts, giving attackers continued access unless the infection is removed.

The use of images complicates detection because the downloaded files can resemble ordinary web graphics. However, a PNG file is not inherently executable: additional malicious instructions must extract and launch the concealed content. The attack therefore relies on both social engineering and a functioning execution chain.

Huntress has separately analysed ClickFix campaigns delivering LummaC2 and Rhadamanthys information stealers through encrypted payloads encoded into PNG colour channels. In those cases, a loader recovered the hidden material and executed subsequent stages in memory, reducing the need to write recognisable malware files to disk.

Another investigation by security company Vega, published on 26 October, identified a different approach. Its researchers recovered a PNG image carrying readable shell commands inside its colour palette, while a fake Cloudflare page supplied instructions intended to locate and execute the material from locally stored browser content.

Vega said two customer workstations had recorded suspicious commands in Windows Run history. Its investigation established delivery of the image carrier but did not confirm that the hidden commands were successfully extracted and executed on those machines. The distinction limits what can be concluded about the observed impact.

The researchers also found that the compromised WordPress website assessed visitors before displaying its counterfeit verification page. Such filtering can help attackers conceal malicious content from automated security scanners while presenting the lure to selected human visitors.

Microsoft has identified ClickFix as a broader social-engineering method used by multiple threat actors. Its investigations describe websites that imitate Cloudflare Turnstile and other familiar verification interfaces, then manipulate visitors into running commands that bypass the normal boundaries between browsing and operating-system administration.

Microsoft’s threat intelligence researchers have also identified commercial ClickFix toolkits advertised on underground forums. These packages provide configurable imitation verification pages and malicious command generators, allowing operators to adapt their campaigns without developing every component independently. Some incorporate mechanisms intended to evade security controls and maintain access after infection.

New Zealand’s National Cyber Security Centre warned in September that compromised websites, including WordPress installations, were displaying fake CAPTCHA and Cloudflare pages. The agency advised website operators to remove injected scripts, investigate the original compromise and eliminate mechanisms capable of restoring malicious content.

Security specialists distinguish these counterfeit pages from genuine Cloudflare checks, which do not require visitors to open Windows Run, launch PowerShell or paste commands into a system utility. Users who encounter those instructions are advised to close the page without executing them.

The Westlaw-themed incident illustrates how a paid search placement can become an entry point even when the initial search concerns a legitimate professional service. The spoofed website used the familiar product identity to reinforce the credibility of the fraudulent verification step.