ClickFix Social Engineering Technique — Fake Cloudflare Turnstile Just a Moment Verification Lure

ClickFix is a widely reported in-the-wild social-engineering technique in which a fake CAPTCHA or “verification” page tricks a victim into copying an attacker-controlled command (silently injected into the clipboard by the page) and pasting/executing it themselves via the Windows Run dialog (Win+R) or PowerShell. This entry mirrors a real, working ClickFix lure page — 0x204/ClickFix-Turnstile — that impersonates Cloudflare Turnstile’s “Just a moment…” human-verification interstitial. The page walks the victim through a fake checkbox click, silently overwrites the clipboard with an attacker-defined command via a hijacked copy event, and then displays instructions telling the victim to press Win+R, paste with Ctrl+V, and press Enter to “complete verification” — actually executing the injected command via Run. The shipped placeholder command is the benign string webshell, not a functional dropper; an operator would need to substitute their own payload (e.g. a mshta/powershell one-liner) for this to cause real harm.

Root Cause

This is not a memory-safety or logic vulnerability in software — it exploits user trust in a familiar UI pattern (Cloudflare’s real “Just a moment…” bot-check interstitial) combined with a browser feature (scripted control over the copy clipboard event) that lets a web page silently substitute clipboard contents. There is no technical flaw being exploited on the victim’s machine; the “vulnerability” is purely social — victims are conditioned to click through CAPTCHA-style checks and are not used to scrutinizing what a “Copy” action actually places on their clipboard before pasting it into a privileged execution context like Run or a terminal.

Attack Vector

1. Victim is directed (via phishing email, malvertising, compromised site, or search-poisoning) to a page running this lure, optionally with ?site= and ?logo= query parameters that spoof the displayed domain name and favicon to match a trusted brand.
2. The page renders a pixel-accurate clone of Cloudflare’s “Just a moment…” Turnstile interstitial, including a fake Ray ID (generateRayId()) and a fake reCAPTCHA-style verification ID (generateVerificationId()) to look legitimate.
3. Victim clicks the checkbox (#checkbox); the click handler calls copyToClipboard(CONFIG.command), and a document.addEventListener("copy", ...) override additionally force-sets e.clipboardData / window.clipboardData to CONFIG.command on any copy event, guaranteeing the attacker-chosen string ends up on the clipboard regardless of what the page visually shows as “copied.”
4. The verification panel then instructs the victim, in the victim’s own language (18 locales are supported via an i18n string table): “Press & hold the Windows Key + R”, “In the verification window, press Ctrl+V”, “Press Enter on your keyboard to finish.”
5. Victim follows the on-screen steps, unknowingly opening the Windows Run dialog, pasting the attacker’s clipboard-injected command, and pressing Enter — executing it with their own user privileges.
6. In this repository’s shipped configuration, CONFIG.command is the harmless placeholder string "webshell"; a real attacker would replace it with an actual command (e.g. a PowerShell/mshta downloader-and-execute one-liner) before deployment.

Impact

If weaponized with a real payload in place of the placeholder, this technique achieves arbitrary command execution on the victim’s Windows host as the logged-in user — entirely through social engineering, without any browser exploit or software vulnerability, and without triggering typical download/attachment-based AV or email-gateway scanning since no file is ever “downloaded” by the victim. As shipped in this repo, the command is inert (webshell), so there is no functional impact out of the box.

Target:      Any modern browser (Chrome/Edge/Firefox) on Windows, for realistic demonstration of the Win+R flow
Attacker:    Any static web host (or `python3 -m http.server`) to serve index.html/main.js/styles.css
Tools:       Browser DevTools (to observe the clipboard-override behavior), a plain-text editor to inspect main.js

Setup Steps

1
2
3
4

cd 2026-07-27_clickfix-cloudflare-turnstile-lure
unzip -P infected poc-files.zip

python3 -m http.server 8000

Step-by-Step Reproduction

1. Serve the page — Host index.html, main.js, and styles.css from any static web server.

   Shell script Copy

   1	python3 -m http.server 8000

2. Load it in a browser — Navigate to the page; it renders the fake Cloudflare “Just a moment…” Turnstile check, complete with a spoofed Ray ID.

   Output Copy

   http://localhost:8000/index.html

3. Click the checkbox — This fires copyToClipboard(CONFIG.command) and arms the copy event override, then reveals the “Win+R / Ctrl+V / Enter” instruction panel.

4. Follow the on-screen steps (Win+R, Ctrl+V, Enter) — Confirm the placeholder string webshell (not a real command) lands in the Run dialog, demonstrating the clipboard-injection mechanic without executing anything harmful.

Exploit Code

See poc-files.zip (password: infected) in this folder, containing index.html and main.js (plus styles.css, shipped as plaintext since it carries no executable/lure logic) — mirrored byte-for-byte from the upstream repository (see Notes for why index.html/main.js are zipped rather than committed as plaintext).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

// main.js (excerpt) — the core clipboard-injection primitive
const CONFIG = {
  command: "webshell"   // placeholder; a real attacker substitutes their own command here
};

function copyToClipboard(text) { /* ... execCommand('copy') fallback path ... */ }

document.addEventListener("copy", (e) => {
  if (e.clipboardData) {
    e.clipboardData.setData('text/plain', CONFIG.command);
  } else if (window.clipboardData) {
    window.clipboardData.setData('Text', CONFIG.command);
  }
});

// wired to the fake "I am not a robot" checkbox:
// checkbox.addEventListener("click", () => { copyToClipboard(CONFIG.command); ... });

Expected Output

Clipboard contents after clicking the checkbox: "webshell"
(In a weaponized deployment, this would instead be the operator's real command,
executed the moment the victim pastes it into Win+R and presses Enter.)

• Upstream repository README embeds a screenshot of the rendered lure (spoofed “Just a moment…” Cloudflare Turnstile check) — see upstream-README.md for the original image link.

Endpoint-side signs of compromise:

• explorer.exe spawning powershell.exe, cmd.exe, or mshta.exe moments after a Run-dialog (Win+R) invocation with no corresponding legitimate admin action
• Clipboard history containing a command line pasted from a browser tab showing a CAPTCHA/verification page
• Browser process having recently rendered a page whose DOM contains document.addEventListener("copy", ...) clipboard overrides

• Source repository
• General background: ClickFix is a widely documented in-the-wild social-engineering technique (fake CAPTCHA/verification pages that trick victims into pasting clipboard-injected commands into Run/PowerShell); see vendor and researcher writeups on “ClickFix” for broader campaign context.

Verified before ingestion: the real upstream files (index.html, main.js, styles.css) were cloned directly from https://github.com/0x204/ClickFix-Turnstile and copied into this entry byte-for-byte (diffed against the clone, confirmed identical) — no code was paraphrased or rewritten. Manual review of main.js confirmed a genuine, functional clipboard-injection mechanism: copyToClipboard() plus a document.addEventListener("copy", ...) override that force-sets the clipboard to CONFIG.command on the fake checkbox click, wired into a convincing Cloudflare Turnstile “Just a moment…” clone with 18-locale i18n strings, dynamic favicon/domain spoofing via ?site=/?logo= query parameters, and fake Ray ID/verification ID generators. CONFIG.command ships as the benign placeholder "webshell" — not a functional dropper or payload. The repository was grepped for common exfiltration/gating indicators (telegram, discord, webhook, fetch, eval, atob, payment, crypto, onion) with no hits: no hidden C2, no phone-home, no payment gating, no unrelated dropper bundled in.

Author-credibility caveat (flagged plainly, not a rejection reason): the commit author (email pauloromire@gmail.com, active Nov 2025) maintains 16 repositories with a “vibe-coder” bio, including a Cloudflare Turnstile solver extension alongside unrelated offensive tools — a Discord voice-channel disruption tool and a raw-TCP DDoS tool. This profile reads as an offensive-tooling hobbyist rather than an established or vetted security researcher. That caveat applies to the author’s broader body of work, not to this specific repository, whose code was independently reviewed and found clean of hidden malicious functionality.

This is a SOCIAL-ENGINEERING / AWARENESS demonstration, not a software vulnerability — there is no CVE, no CVSS score, and no vendor patch applicable. The entry exists to document a real, reproducible instance of the ClickFix technique (specifically the Cloudflare Turnstile impersonation variant) for detection-engineering and user-awareness purposes, mirroring how this archive treats other no-CVE ClickFix lure variants already catalogued under this category.