Fake Google and Cloudflare Verification Pages Spread Multiple Malware Families

Date: 07/09/2026

Severity: High

Summary

Threat actors are abusing fake Google and Cloudflare verification pages in evolving ClickFix campaigns to socially engineer users into executing malicious commands on their own systems. These campaigns distribute multiple malware families, including HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport, and a Rust-based stealer. In one attack chain, a trojanized Franz messaging application installs the newly identified ResiLoader, which disables security software before deploying the StealC infostealer.

Indicators of Compromise (IOC) List

Domains/URLs

onegeekworld.com

thefirmos.com

antibotv3.com

centralwildcats.com

cloud.antibotv3.com

cloudautosolutions.com

sunseekersupply.com

123clocks.com

orcanegames.com

rwmonitoring.com

100furniture.com

nepalcharchaa.com

p-floribunds.pages.dev

pg-altirade2.pages.dev

pg-cordivant-m6.pages.dev

g-luminence.pages.dev

generator-qrcode.online

regdev-google.com

khosla.capital

eorgke09054909j.com

dropboxi.com

pub-4ed7b8ecee744dea930d74ba4ac74285.r2.dev

pub-620528e2dc874e16937673265aa23d39.r2.dev

pub-4ed7b8ecee744dea930d74ba4ac74285.r2.dev

pub-9682d5896df841679c5a17eb41273f89.r2.dev

pub-18d99d0d18b94e85824c1cc4d5b5c637.r2.dev

pub-0170eabb9df346bd822f863b7c3946e3.r2.dev

pub-4ed7b8ecee744dea930d74ba4ac74285.r2.dev

unitedstateverif.com

bigflaredefence.com

popularcard.shop

xzz.proxygrid.cc

completstep.com

eventlogerps1.ink

be231ro963.com

IP Address

151.240.151.126

85.239.149.16

85.239.149.40

93.152.224.29

151.240.151.46

93.152.224.167

85.239.149.78

192.69.195.131

135.181.171.40

94.26.83.206

91.92.34.128

85.239.144.31

93.152.224.39

94.26.90.112

146.19.248.120

Hash

72907d0ca3258365838626f6a8d993a6

0234E3188F2883A438B3F2BEAB7A78B2

6a9ac6b3fff7b695dbd4df6ff7f6c516

206ce339febca0c3bcc850f42595fc63

eee416efcb1e33f220cdb4b05496a07a

B8d53740024d126cb55f83854335a4ab

f66dd0116aab327fe383bc3f28a6a506cd6c53973ad6cc628cb637f44a96f356

872d8079ab450bfd1417b9128b619f7e9b43291dc7391044dd838f5b7e8dde52

1e08cb2059eaac6ddff026932eb39cc58e05a4e72393bfee2864ef362a5c85fa

26d2d149b8beef18fa5e875897f168902d4f099cfdf5adbbcf3962ae9026aeb0

acc46f5a8bbaf83eb8f3c9f7a96adb76bf14ed56aa113c60dd44780d7c505965

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Detection Query 1 :	domainname like "thefirmos.com" or url like "thefirmos.com" or siteurl like "thefirmos.com" or domainname like "pub-9682d5896df841679c5a17eb41273f89.r2.dev" or url like "pub-9682d5896df841679c5a17eb41273f89.r2.dev" or siteurl like "pub-9682d5896df841679c5a17eb41273f89.r2.dev" or domainname like "orcanegames.com" or url like "orcanegames.com" or siteurl like "orcanegames.com" or domainname like "bigflaredefence.com" or url like "bigflaredefence.com" or siteurl like "bigflaredefence.com" or domainname like "generator-qrcode.online" or url like "generator-qrcode.online" or siteurl like "generator-qrcode.online" or domainname like "dropboxi.com" or url like "dropboxi.com" or siteurl like "dropboxi.com" or domainname like "centralwildcats.com" or url like "centralwildcats.com" or siteurl like "centralwildcats.com" or domainname like "100furniture.com" or url like "100furniture.com" or siteurl like "100furniture.com" or domainname like "g-luminence.pages.dev" or url like "g-luminence.pages.dev" or siteurl like "g-luminence.pages.dev" or domainname like "xzz.proxygrid.cc" or url like "xzz.proxygrid.cc" or siteurl like "xzz.proxygrid.cc" or domainname like "completstep.com" or url like "completstep.com" or siteurl like "completstep.com" or domainname like "nepalcharchaa.com" or url like "nepalcharchaa.com" or siteurl like "nepalcharchaa.com" or domainname like "regdev-google.com" or url like "regdev-google.com" or siteurl like "regdev-google.com" or domainname like "pg-cordivant-m6.pages.dev" or url like "pg-cordivant-m6.pages.dev" or siteurl like "pg-cordivant-m6.pages.dev" or domainname like "eventlogerps1.ink" or url like "eventlogerps1.ink" or siteurl like "eventlogerps1.ink" or domainname like "p-floribunds.pages.dev" or url like "p-floribunds.pages.dev" or siteurl like "p-floribunds.pages.dev" or domainname like "cloudautosolutions.com" or url like "cloudautosolutions.com" or siteurl like "cloudautosolutions.com" or domainname like "pub-0170eabb9df346bd822f863b7c3946e3.r2.dev" or url like "pub-0170eabb9df346bd822f863b7c3946e3.r2.dev" or siteurl like "pub-0170eabb9df346bd822f863b7c3946e3.r2.dev" or domainname like "pub-620528e2dc874e16937673265aa23d39.r2.dev" or url like "pub-620528e2dc874e16937673265aa23d39.r2.dev" or siteurl like "pub-620528e2dc874e16937673265aa23d39.r2.dev" or domainname like "pub-4ed7b8ecee744dea930d74ba4ac74285.r2.dev" or url like "pub-4ed7b8ecee744dea930d74ba4ac74285.r2.dev" or siteurl like "pub-4ed7b8ecee744dea930d74ba4ac74285.r2.dev" or domainname like "rwmonitoring.com" or url like "rwmonitoring.com" or siteurl like "rwmonitoring.com" or domainname like "eorgke09054909j.com" or url like "eorgke09054909j.com" or siteurl like "eorgke09054909j.com" or domainname like "pub-18d99d0d18b94e85824c1cc4d5b5c637.r2.dev" or url like "pub-18d99d0d18b94e85824c1cc4d5b5c637.r2.dev" or siteurl like "pub-18d99d0d18b94e85824c1cc4d5b5c637.r2.dev" or domainname like "pg-altirade2.pages.dev" or url like "pg-altirade2.pages.dev" or siteurl like "pg-altirade2.pages.dev" or domainname like "antibotv3.com" or url like "antibotv3.com" or siteurl like "antibotv3.com" or domainname like "popularcard.shop" or url like "popularcard.shop" or siteurl like "popularcard.shop" or domainname like "123clocks.com" or url like "123clocks.com" or siteurl like "123clocks.com" or domainname like "unitedstateverif.com" or url like "unitedstateverif.com" or siteurl like "unitedstateverif.com" or domainname like "sunseekersupply.com" or url like "sunseekersupply.com" or siteurl like "sunseekersupply.com" or domainname like "onegeekworld.com" or url like "onegeekworld.com" or siteurl like "onegeekworld.com" or domainname like "be231ro963.com" or url like "be231ro963.com" or siteurl like "be231ro963.com" or domainname like "cloud.antibotv3.com" or url like "cloud.antibotv3.com" or siteurl like "cloud.antibotv3.com" or domainname like "khosla.capital" or siteurl like "khosla.capital" or url like "khosla.capital"
Detection Query 2 :	dstipaddress IN ("94.26.90.112","151.240.151.126","85.239.144.31","94.26.83.206","93.152.224.29","85.239.149.16","93.152.224.167","151.240.151.46","93.152.224.39","135.181.171.40","146.19.248.120","192.69.195.131","85.239.149.40","85.239.149.78","91.92.34.128") or srcipaddress IN ("94.26.90.112","151.240.151.126","85.239.144.31","94.26.83.206","93.152.224.29","85.239.149.16","93.152.224.167","151.240.151.46","93.152.224.39","135.181.171.40","146.19.248.120","192.69.195.131","85.239.149.40","85.239.149.78","91.92.34.128")
Detection Query 3 :	`md5hash IN ("6a9ac6b3fff7b695dbd4df6ff7f6c516","b8d53740024d126cb55f83854335a4ab","206ce339febca0c3bcc850f42595fc63","72907d0ca3258365838626f6a8d993a6","eee416efcb1e33f220cdb4b05496a07a","0234E3188F2883A438B3F2BEAB7A78B2")`
Detection Query 4 :	`sha256hash IN ("f66dd0116aab327fe383bc3f28a6a506cd6c53973ad6cc628cb637f44a96f356","872d8079ab450bfd1417b9128b619f7e9b43291dc7391044dd838f5b7e8dde52","1e08cb2059eaac6ddff026932eb39cc58e05a4e72393bfee2864ef362a5c85fa","26d2d149b8beef18fa5e875897f168902d4f099cfdf5adbbcf3962ae9026aeb0","acc46f5a8bbaf83eb8f3c9f7a96adb76bf14ed56aa113c60dd44780d7c505965")`

Reference:

https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families

Fake Google and Cloudflare Verification Pages Spread Multiple Malware Families

Summary

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Tags

Comments

Fake Google and Cloudflare Verification Pages Spread Multiple Malware Families

Summary

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Tags

Share This

Comments