ClockTail ClickFix kit
ClockTail is a ClickFix page that turns ordinary controls into a fake Cloudflare check and fetches clipboard text when the visitor clicks. We have matched it on 181 sites since 15 August.
ClockTail in numbers
Since 15 August, the first ClockTail match in our records, counted on 12 November 2026. How we count.
| Sites with ClockTail code | 181 |
|---|---|
| Sites with a match in the last 30 days | 109 |
| New sites in October | 79 |
| Sites captured since 25 September | 123 |
The lure waits behind the real page
ClockTail is a ClickFix page that intercepts the site's ordinary controls. A document-level handler catches the nearest link, button, ARIA button or submit input. Clicking one blocks the original action, opens a modal and starts the command request. Form submissions are blocked the same way.
The modal imitates a Cloudflare robot check. It shows a generated verification ID and an "I'm not a robot" box. Clicking the box expands "Complete the Verification Steps" after 300 milliseconds, with four instructions: press Win+R, paste, press Enter and wait for a Continue button. The modal has no close control. Its Verify button sends the visitor to a local verification-failed.html page.
The command arrives after the first click
The template expects a command-file address in WINR. It appends Date.now() to that value, fetches the resulting URL as text and trims the reply. The timestamp changes on every attempt, which bypasses a cached response.
The script first calls navigator.clipboard.writeText. Its fallback creates an off-screen textarea, selects it, calls document.execCommand('copy') and removes the textarea.
The template carries a literal WINR placeholder where the command address goes. The page source on 6 September and again on 10 October is byte-for-byte identical, including that placeholder and the four-step lure.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October | 79 |
| November so far | 101 |
None of the 123 ClockTail sites captured since 25 September ran WordPress.
Checking a site
Search the HTML and rendered page for:
- a
WINRvalue joined toDate.now()beforefetch - a document click listener targeting links, buttons, ARIA buttons and submit inputs
cf-modal-overlay,cf-instructionsand a generatedcf-vid- the four Win+R, paste, Enter and Continue instructions
- both Clipboard API and hidden-textarea copy paths
- a Verify button that opens
verification-failed.html
Test in a disposable browser profile and preserve the network log before clicking. The command response, when the placeholder is configured, is separate from the original HTML.