FrameGnaw ClickFix kit

The frame comes before the real page

FrameGnaw inserts an iframe near the start of the response, before the site's normal HTML. Fixed positioning, full width and height, and z-index: 999999 leave the underlying page loaded but hidden. The frame's srcdoc attribute contains the entire verification application, so the browser does not request a separate lure document.

The inner document carries its own styles, reCAPTCHA image, Bootstrap links, clipboard handler and command.

From checkbox to cmd

The visitor first sees an "I'm not a robot" checkbox. Clicking it copies the command, replaces the checkbox with a spinner and opens a modal half a second later. The modal gives five steps: press Win+R, type cmd, press Enter, paste with Ctrl+V, then press Enter again. A same-origin /base_video path supplies optional video instructions.

The page generates a four-digit verification ID separately from its copied command. Its Verify button stays disabled for one minute. Closing the modal resets the checkbox and allows the sequence to start again.

The encoded command changes between copies

The iframe creates a temporary textarea, selects it and calls document.execCommand('copy'). Both builds use this command shape:

powershell -NoP -NonI -EP Bypass -e [Base64 command]

The Base64 decodes as UTF-16LE PowerShell. The later capture kept the same iframe, modal, timing and clipboard code while changing the address and identifier inside that encoded command.

What we see

Month	New sites
September	4
October	0
November so far	0

FrameGnaw last matched on 18 September.

Checking a site

Inspect the raw response before the browser renders it. Look for:

• a fixed full-screen iframe with a large srcdoc attribute
• "Complete these Verification Steps" and instructions to type cmd
• a textarea passed to document.execCommand('copy')
• PowerShell using -NoProfile, -NonInteractive, -ExecutionPolicy Bypass and -EncodedCommand, or their short forms
• same-origin requests for /static/bootstrap.min.css, /static/bootstrap.bundle.min.js or /base_video from a page that does not use them

Decode the Base64 command when checking a captured response.