CLEARSHORT ClickFix kit

Who named it

Google's threat intelligence group (GTIG) published CLEARSHORT in October 2025 as the downloader used by UNC5142, a financially motivated group, and describes it as the successor to the ClearFake downloader that group used from late 2023 to mid-2024 (GTIG). Sekoia covered the same code in March 2025 (Sekoia).

GTIG counted about 14,000 web pages carrying UNC5142's injected script as of June 2025. We have matched CLEARSHORT on 159 sites since 10 August.

On the site

GTIG reports the first-stage script going into plugin files, theme files such as header.php and footer.php, or straight into the WordPress database. In our captures it sits inline in the page source as plain code, code obfuscated with a string table, or a large Base64 blob run through new Function. Optimisers such as NitroPack keep their own rewritten copies, so a cleaned theme file can still leave the script in the cache.

Three contracts per visit

The injected script loads three libraries from public CDNs, Web3.js, pako and crypto-js, then talks to BNB Smart Chain through bsc-dataseed.binance.org:

1. It reads a fixed router contract on BNB Smart Chain mainnet, which returns the address of a logic contract and that contract's interface, Base64-encoded and gzipped. The main router is 0x9179dda8b285040bf381aabb8a1f4a1b8c37ed53; the secondary router is 0x8f386ac6050b21af0e34864eabf0308f89c6f13c.
2. It calls tokyoSkytree() on the main or secondary logic contract, unpacks the reply with pako.ungzip and runs it.
3. That code calls more functions named after Tokyo landmarks: shibuyaCrossing() reads the visitor's operating system, akihabaraLights() their browser, and ginzaLuxury() asks the main or secondary storage contract for a landing page matching both.
4. The landing page arrives encrypted with AES-GCM, is decrypted with a key from the storage contract and opens in a full-screen frame, with the infected site's own domain written into it.

The router address written into a site never changes. To change the lure, the key or the download address, the operator sends one cheap transaction to the logic or storage contract, and every site loading that router follows.

The lures and the command

The lures have changed with the campaign. GTIG and Sekoia trace them from fake Chrome updates in the ClearFake era, through fake reCAPTCHA and "Disable Data Collection" prompts at the turn of 2025, to fake Cloudflare Turnstile pages claiming unusual traffic from the visitor's IP and, from May 2025, "Anti-Bot Verification" pages with steps for Windows and macOS. The storage contracts we read on 11 September offered a Captcha page and a Client page for Windows visitors on Chrome, Firefox, Edge and Opera.

On Windows the lure tells the visitor to press Win+R, paste and press Enter. GTIG reports the command using mshta to run a remote HTA file, and since February 2025 the command itself has come from the blockchain. Mac visitors are given a Terminal command built on curl.

What we see

Month	New sites
September	66
October	31
November so far	8

91% of the CLEARSHORT sites captured since 25 September run WordPress.

Checking a site

Search the page source, theme files (header.php, footer.php, index.php), plugin files and the database for:

• orchidABI, orchidAddress, merlionABI, tokyoSkytree or pako.ungzip
• either router address beside tokyoSkytree() calls
• Web3.js, pako and crypto-js loaded together from a CDN on a site with no blockchain features
• a large Base64 string decoded with atob and passed to new Function

In the browser, a cookie named data-ai-collecting-shown on your site's domain is a sign of CLEARSHORT. Requests from your site to bsc-dataseed.binance.org show your page contacting BNB Smart Chain. Clear optimiser caches after cleaning.