I ran a fake Cloudflare ClickFix command and disconnected after ~15 seconds — how compromised should I assume I am?

I ran a fake Cloudflare ClickFix command and disconnected after ~15 seconds — how compromised should I assume I am?

I visited what appears to be a legitimate German bakery website using Microsoft Edge on Windows 11. The site displayed a convincing fake Cloudflare “Verify you are human” page.

Lure site, defanged for safety:

"hxxps://www[.]baeckerei-spiegelhauer[.]de/"

It was reached through a Google search result containing an "srsltid" query parameter. The malicious page was reproducible on a second computer and generated a different victim token. Researchers may be able to reproduce it in a properly isolated VM or sandbox. Please do not visit it from a normal system.

After clicking the verification box, I was instructed to press Win + R, paste a command, and click OK. Unfortunately, I did exactly that. There was no UAC/admin prompt. I realised what had happened and disconnected the PC from the internet approximately 15 seconds later. It has remained offline since then.

The command was an obfuscated CMD one-liner that:

– located conhost.exe and cmd.exe;

– launched a hidden/headless console;

– located curl.exe;

– contacted "cloudmail2077[.]com";

– piped the server response directly into cmd.exe.

I have deliberately not included the complete executable command or victim token publicly, but I can provide a screenshot or defanged version to established researchers.

Important details:

– Windows 11 with Microsoft Defender

– Microsoft Edge was open

– Edge contains saved passwords and active login sessions

– The passwords require my Windows user password before Edge displays them

– No UAC prompt appeared

– The PC has another separate Windows user account belonging to a family member

– A full Defender scan is currently running

– The current DNS cache contains no entry for the malicious domain

– Prefetch appears to be disabled, as there are no entries for either CMD or CURL

– The command was not executed on the second computer

– The website and malicious domain have been reported to Microsoft SmartScreen, the Swiss NCSC/BACS and Cybercrimepolice

My questions:

1. Is 15 seconds enough for a typical ClickFix infostealer chain to download, execute and exfiltrate browser passwords or cookies?

2. Which volatile evidence, Windows logs or recently created files should I preserve before shutting down or reinstalling?

3. Should I consider all Edge passwords and active sessions compromised even without administrator privileges?

4. Is a complete clean Windows installation the only trustworthy option, even if Defender finds nothing?

5. Does the separate Windows user account have a meaningful risk if it was not logged in at the time?

The affected PC is still powered on but completely offline. I am changing passwords and revoking sessions from a clean device. Any specific incident-response or sandbox-analysis guidance would be appreciated.