Birdeye ClickFix kit

Recorded Future named the code Birdeye

Recorded Future's Insikt Group calls this ClickFix lure "Cluster 3: Birdeye" and published its source. The name has nothing to do with Birdeye, the review-widget company.

Seven arrays build the command

The source defines seven arrays under obfuscatedCommandParts. Its builder maps each array through String.fromCharCode, joins the decoded fragments and keeps the completed command in one variable.

The pages we capture carry that source unchanged: the same arrays, builder, Russian comments and fake Cloudflare page. The decoded command is PowerShell that downloads a text file from alababababa[.]cloud through Net.WebClient and runs it.

The checkbox controls the clipboard

Clicking the fake check writes the assembled command into a hidden text area and calls document.execCommand('copy'). A global copy handler replaces anything else the visitor copies with that command.

The page then shows the Win+R steps. When the visitor finishes, it posts to /verify-complete and reloads.

What we see

Month	New sites
September	0
October	3
November so far	0

Finding the Birdeye lure

Search the raw response and rendered page for:

• obfuscatedCommandParts containing the char-code arrays
• String.fromCharCode(...partArray) followed by join('')
• a fake Cloudflare check with Win+R instructions
• a hidden text area passed to document.execCommand('copy')
• a global copy handler that sets text/plain to the assembled command
• a completion request to /verify-complete

Remove the lure and the server-side change that placed it. Review hosting and deployment access and rotate their credentials.