More fake Cloudflare checks on cloudfiare.io and cloudfiare-verification domains spread malware

What happened

Threat researcher @Malwarehunterr posted on X on 10 November 2026 about more fake Cloudflare verification pages using the look-alike spelling 'cloudfiare'. The post listed the domains cloudfiare-verification[.]net, cloudfiare-verification[.]app and cloudfiare[.]io, with URLs including hxxps://cloudfiare[.]io/u/ and hxxps://cloudfiare[.]io/Outline.zip. According to the post, the pages trick users into running obfuscated PowerShell commands through Win+R; the scripts download a ZIP, extract outline.exe and run it through a Windows scheduled task. The payload SHA-256 given was cc012b669596aa4e5250d4a77b65a2ac52b3fc66bb01d9a45d6b1062d35e548e. Cloudflare is impersonated and is not the operator. Never paste commands into Win+R or PowerShell because a web page tells you to.

How the scam works

This follows the same fake-verification pattern as other look-alike Cloudflare checks: a page tells the visitor to press Windows+R and paste an obfuscated PowerShell command. According to the researcher, the script downloaded a ZIP from the cloudfiare.io addresses, extracted outline.exe and ran it through a Windows scheduled task, which can keep the payload running after a reboot.

The spelling "cloudfiare" is a deliberate look-alike of Cloudflare. Cloudflare does not operate cloudfiare.io, cloudfiare-verification.net or cloudfiare-verification.app, and a genuine verification page will never ask you to paste a command. If you ran a command from one of these pages, disconnect the computer, avoid entering more passwords on it, and have the device examined. The indicators come from the researcher's public post and have not been independently checked by scammers.com.

Source

Public post on X, 10 November 2026: https://x.com/Malwarehunterr/status/2120083867428417712

The indicators come from this source and have not been independently checked by scammers.com.