CookieDam ClickFix kit

One small footer block controls the visit

CookieDam is a loader inserted near the end of a compromised page. One form is a short clear-text script with the overlay host written in. Another hides the same 687-byte script inside eval(atob(...)), and copies from separate sites in September and October carry the same wrapper.

A third build, on infected pages since September 2026, sits inline in the page HTML and reads its overlay host from a smart contract. Its Base64 blob runs to 3,664 characters and decodes to a 2,748-byte script, four times the size of the others.

The cookie closes the gate for a year

On each visit, CookieDam follows this sequence:

1. It registers a window message listener for the word reload.
2. It checks for the cookie-captcha-complete cookie.
3. With no cookie present, it fetches a remote document as text.
4. A non-empty reply is added to the end of the page body with insertAdjacentHTML('beforeend', html).
5. An empty reply sets the cookie for one year.

The inserted document can post the reload message to refresh the compromised page. The one-year cookie is written only for an empty response, so the remote server controls whether a visitor reaches the fetch again on a later page view.

An Ethereum contract names the overlay host

The contract-backed build sends eth_call to 0xd3b72fd8acfe7ddff21de37bee562df2fa32e287 with selector 0x73d4a13a. It tries five public Ethereum mainnet RPC services in turn, moving on at any failure: ethereum-rpc.publicnode.com, eth.blockrazor.xyz, 0xrpc.io/eth, rpc.mevblocker.io and 1rpc.io/eth.

It skips a reply of 128 hex characters or fewer, reads the ABI string, strips anything unprintable and adds https:// when the value has no scheme. On 1 November 2026 the contract returned hxxps://clou-dprotect[.]com. The cookie gate, the fetch and the reload listener then run as in the other builds.

The EtherHiding contract tracker follows the CookieDam contract and every destination we have decoded from it.

What we see

Month	New sites
September	38
October	17
November so far	4

Of the 36 sites recaptured at least 25 days after their first match, 33 were still serving CookieDam (92%). 92% of CookieDam sites captured since 25 September run WordPress.

21 CookieDam sites also carry ChainBite.

Checking a WordPress site

Search raw page responses, footer injections and cached HTML for:

• the cookie name cookie-captcha-complete
• a fetch whose text response flows into insertAdjacentHTML('beforeend', ...)
• a window message handler that reloads the page for the value reload
• an eval(atob(...)) block that decodes to those operations
• eth_call requests to Ethereum mainnet RPC services with selector 0x73d4a13a, followed by a fetch to the returned host

Check the server response as well as the rendered document. Remove the source injection, then purge page, plugin and CDN caches before checking again.