ConfigGnaw ClickFix kit
ConfigGnaw is a verification page whose clipboard command comes from a same-origin config endpoint. We have matched it on 2 sites since 4 August.
ConfigGnaw in numbers
Since 4 August, the first ConfigGnaw match in our records, counted on 12 November 2026. How we count.
| Sites with ConfigGnaw code | 2 |
|---|---|
| Sites with a match in the last 30 days | 0 |
| New sites in October | 1 |
| Still serving it when recaptured at least 25 days later | 0 of 1 site (0%) |
The HTML keeps its command out of view
ConfigGnaw is a complete fake Cloudflare verification page. Its HTML supplies the checkbox, staged instructions, Verify button and generated Ray ID. The command arrives separately from /api/config.php, requested with cache: "no-store" when the page loads.
An August build expected one Base64 field named command. By October the same page code selected command_windows or command_mac from the browser platform, with the original field as a fallback. Both versions read copy_enabled before allowing a clipboard write. The operator can replace or disable the command through the JSON reply while leaving the visible page unchanged.
Four instruction branches
The lure changes its instructions from the user agent. Windows visitors get Win+R and paste steps. Mac visitors are told to open Terminal through Spotlight. Linux and Android see prompts to wait for a file, run it and return to the page; the Android text includes an "Allow from this source" step.
The browser follows the same timed sequence on every platform:
- After 1.5 seconds, the verification box fades in. Two seconds later the checkbox replaces the loading step.
- Clicking the checkbox copies the decoded command when
copy_enabledis true. The page usesnavigator.clipboard.writeTextand falls back to a hidden textarea withdocument.execCommand("copy"). - The instruction panel opens, but the Verify button remains disabled for 15 seconds.
- Clicking Verify sets
mac_checked=1for 30 days, briefly shows a success state and redirects to the address from the config reply or the site's parent address.
A document-level copy listener applies the same command to any other copy action while copying is enabled.
The October change
The later build adds a commandForPlatform() function. It runs the same detector used for the visible instructions, picks the Mac field only for macintosh, decodes the selected Base64 as UTF-8 and stores the result in _cmdText.
The rest of the implementation stayed recognisable: _copyEnabled, checkbox-window, verify-button, the 15-second delay and the 30-day cookie all remain. The server-delivered HTML contains the fetch and decoder; the live endpoint reply carries the command.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October | 1 |
| November so far | 0 |
Of the 1 site recaptured at least 25 days after their first match, 0 were still serving ConfigGnaw (0%).
Checking a page
Inspect the HTML and /api/config.php together. Search for:
- a no-store fetch of
/api/config.php command,command_windows,command_macandcopy_enabledin the JSON handling_cmdText,_copyEnabledandcommandForPlatform- elements named
checkbox-window,verify-buttonandray-id - a
mac_checkedcookie with a 30-day lifetime
Capture the JSON response while testing from each supported platform. That response, rather than the original HTML, supplies the command.