Fake Cloudflare check at cloudflare.life tricks users into running PowerShell malware

What happened

Threat researcher @Malwarehunterr posted on X on 10 November 2026 that the domain cloudflare[.]life impersonates Cloudflare and hosts a fake verification page (a 'ClickFix' lure) that tricks visitors into opening PowerShell and running a malicious command. According to the post, the script downloads and runs a trojan disguised as balenaEtcher_2.exe (SHA-256 a19e768f170561ac19b8b62533643185b80b4facdf387e805f8485d10da80f3d) from hidread[.]net/second/645228a4851493dd. Cloudflare and balenaEtcher are impersonated and are not the operators. A real website security check never asks you to press Win+R or paste a command into PowerShell or Run.

How the scam works

These pages impersonate a familiar security check, here a Cloudflare human-verification screen, and then tell the visitor that the check failed unless they run a command themselves. Typical instructions ask the person to press Windows+R, paste a long PowerShell command and press Enter. That command, according to the researcher, downloaded a trojan disguised as balenaEtcher_2.exe from hidread.net.

A real website security check never asks you to open Run or PowerShell, and Cloudflare does not operate cloudflare.life. If you pasted a command from this or a similar page, disconnect the computer from the network, do not enter more passwords on it, and have the device examined. The indicators come from the researcher's public post and have not been independently checked by scammers.com.

If a colleague or pop-up tells you that a security check requires the Run dialog, stop and verify through a known official channel. Saving and sharing the page address, without running the command, is enough for a report.

Source

Public post on X, 10 November 2026: https://x.com/Malwarehunterr/status/2120077099197411633

The indicators come from this source and have not been independently checked by scammers.com.