FIXED - error="Provided tunnel token is not valid (invalid character '\\x19' in string literal)."

Question

---

I've been getting an error for several days when attempting to create a Cloudflare tunnel to expose my localhost to the internet using a purchased domain. Every time I reach the copy-paste command step ($ cloudflared.exe service install eyJhIjoiNT...), I get the following error:

ERR Unable to determine extra arguments for windows service error="Provided tunnel token is not valid (invalid character '\\x19' in string literal)." windowsServiceName=Cloudflared
Unable to determine extra arguments for windows service: Provided tunnel token is not valid (invalid character '\x19' in string literal).

I always copy the command directly from Cloudflare without typing it manually, so I expected it to work without issues. Cloudflare support mentioned that a hidden character could be causing the error. After viewing the command in HEX format, I found no hidden characters, yet the error persisted even when I manually typed the command.

To troubleshoot, I uploaded the cloudflared file to Triage and ran the command there, expecting it to work, but the same error occurred. Notably, I've connected my tunnel using this exact method before without issues. I need help understanding what’s going wrong this time, as I rely on these tunnels to keep my sites accessible.

---

Update:

I started noticing something strange. Links I copied didn’t look quite right when I pasted them. Even base64 strings, which should’ve been exact, appeared corrupted and off. I initially brushed it off as a glitch or a one-time error, but the problem persisted, and it only got worse.

Curiosity turned into concern as I began to suspect something deeper was going on. Why was this happening so consistently? It wasn’t just one or two instances; it was everything I copied. That’s when I decided to dig deeper, and after some investigation, the answer hit me like a ton of bricks—I had malware on my system.

Not just any malware, though—it was something called a “clipper.” These malicious programs are designed to intercept what you copy, like cryptocurrency wallets, and replace them with the hacker’s wallet. But in my case, it wasn’t just limited to wallets. It was corrupting everything I copied, especially anything with base64 data.

The realization was chilling. Every link, every piece of data I trusted to my clipboard was being hijacked. I wasted no time in taking action, running scans, and removing the malware completely. And finally, after a tense and stressful ordeal, everything went back to normal. Now, I can copy and paste perfectly again—but I’ll never take my clipboard for granted.