DualPrompt ClickFix kit
DualPrompt is a localized fake Cloudflare verification page with separate clipboard commands and instructions for Windows and macOS. We have matched it on 26 sites since 16 September.
DualPrompt in numbers
Since 16 September, the first DualPrompt match in our records, counted on 12 October 2026. How we count.
| Sites with DualPrompt code | 26 |
|---|---|
| Sites with a match in the last 30 days | 26 |
| New sites in September | 10 |
One page carries both platform paths
DualPrompt is our name for a fake Cloudflare page that carries both Windows and macOS clipboard commands. A large inline script stores the site label, both Base64-encoded commands and a challenge value in window.__T. It detects the visitor's operating system in the browser and selects the matching branch.
The macOS value decodes to a shell command that derives a download address from another Base64 string, retrieves the response and passes it to zsh. The Windows value is an obfuscated PowerShell expression that reconstructs its execution and web-request terms at run time. The page only needs one deployed document to address both platforms.
The challenge changes after the first check
The page imitates Cloudflare's "Just a moment..." screen and inserts the compromised site's title and icon. It begins in a checking state, moves to "Performing security verification", then presents a fake checkbox with idle, verifying, success and failure states. A Cloudflare Turnstile link, logo and privacy footer complete the presentation.
Opening the instruction panel reveals three macOS steps and three Windows steps in the same document. The macOS branch directs the visitor to Terminal; the Windows branch directs them to the Run dialog. Both offer Copy and Verify controls and label the copied text as a gateway verification challenge. Unsupported devices receive a message asking for a Windows or macOS desktop or laptop.
The interface strings are supplied by a large localization table, so language can change while the structure and command slots remain the same. The page also sends a beacon back to its own URL with the screen dimensions, browser language and whether WebDriver was detected.
What we see
| Month | New sites |
|---|---|
| September | 10 |
| October so far | 16 |
26 sites had a DualPrompt match in the 30 days to 12 October 2026.
Inspecting both hidden branches
View the raw response and search for:
window.__Tfollowed by two long encoded command values- separate
mac-stepandwin-stepinstruction blocks - a fake Cloudflare checkbox with Copy and Verify controls
- platform detection that selects between macOS and Windows clipboard text
- a localization table containing the verification interface
- a same-page beacon carrying screen, language and WebDriver fields
Decode both command slots during review. A browser on one operating system renders only its selected branch, while the other command remains in the source.