A fake security check on our website

What happened

From 20:00 on 14 October until 10:10 on 15 October 2026, natureconnect.earth showed some visitors a box that looked like a Cloudflare security check. It asked them to press the Windows key and R, then Ctrl and V, then Enter. Those steps run a program that can copy passwords saved in a web browser.

Someone who had gained access to one of our service accounts placed the box there. It has been removed, that access has been closed, and the website is safe to use.

If you visited during those hours

If you visited our website on a Windows computer during those hours and followed the three steps, run a full virus scan and change the passwords saved in your browser, starting with email and banking. If you closed the box, or visited on a phone, tablet or Mac, nothing further is needed.

Questions can go to media@natureconnect.earth.