Windows ClickFix: 'Verify Your Keyboard and Mouse' page with an operator payload panel

Fake Microsoft verification pages ('Verify Your Keyboard and Mouse') that walk the visitor through copying a 'unique verification code', then pressing Windows key + X, I to open Terminal, Ctrl+V and Enter. The code shown on screen is a decoy: the copy button puts a different value on the clipboard, which the operator sets from an admin panel and can change at any time, and the page reports every visitor and copy back to the operator and waits for them to approve the visitor. The kit is a self-hosted single-page app that ships the lure, the admin panel, the visitor tracker and a server deploy wizard in one script. Seen since 2026-10-15 on one server (91.92.242[.]215) that answers with the kit for every hostname pointed at it, including microsoftcloudverification[.]com, atocha-cloud[.]com, xapix[.]one, web-site[.]live and api-xdark[.]com. No legitimate verification step asks visitors to run anything.