Fake verification page at browser-architecture-sync.com pushes ClickFix PowerShell malware

What happened

Threat researcher @Malwarehunterr posted on X on 11 November 2026 about a 'ClickFix' lure at hxxps://browser-architecture-sync[.]com/?step=verify, a fake verification page that tricks visitors into running a PowerShell command. According to the post, the first-stage PowerShell payload is served from hxxps://remote-helpdesk[.]com/sc.ps1 and a second-stage payload was hosted on rigercloud-network[.]com, which the researcher listed as down. A real website check never asks you to press Win+R or paste a command into PowerShell or the Run box.

How the scam works

ClickFix lures impersonate a browser or account verification step and then tell the visitor to press Windows+R, open PowerShell or Terminal, and paste a command. The command is not a security check. It downloads and runs a script from a second host, here listed as remote-helpdesk.com/sc.ps1, which can give the operator a foothold on the computer. A genuine site or helpdesk will never ask you to run a hidden PowerShell payload to finish a captcha or a 'browser architecture' check.

If a page already told you to paste a command, do not run it. Close the tab, and if you did run it disconnect from the network and have the device checked. The indicators come from a public research post and have not been independently checked by scammers.com.

If a colleague or a pop-up tells you that a security check requires the Run dialog, stop and verify through a known official channel. Saving and sharing the page address, without running the command, is enough for a report.

Source

Public post on X, 11 November 2026: https://x.com/Malwarehunterr/status/2120441526329438225

The indicators come from this source and have not been independently checked by scammers.com.