DigitalFlwr ClickFix kit
DigitalFlwr is a ClickFix loader that resolves a remote lure, covers the compromised page with it and copies text sent by the frame. We have matched it on 16 sites since 2 August.
DigitalFlwr in numbers
Since 2 August, the first DigitalFlwr match in our records, counted on 12 November 2026. How we count.
| Sites with DigitalFlwr code | 16 |
|---|---|
| Sites with a match in the last 30 days | 2 |
| New sites in October | 0 |
| Still serving it when recaptured at least 25 days later | 3 of 5 sites (60%) |
| Sites running WordPress (captured since 25 September) | 100% |
From page content to a theme script
The first WordPress copy appeared in page content, where the editor wrapped almost every line in paragraph tags. The browser still repaired enough of the markup to run it.
A later WordPress capture held the same loader at the end of a theme's custom.js file. The surrounding code and delivery point changed, while the two globals, request sequence, iframe styles and clipboard handler stayed the same. Search both database content and deployed JavaScript when cleaning it.
Resolve, check, cover
The loader does not keep the lure address in the compromised site. It follows four steps:
- Fetch a configuration address through the public
corsproxy.iorelay. - Treat the response body as the lure URL.
- Send that URL a
HEADrequest and stop after a failed request or 404. - Cover the page with a fixed iframe at the top left, 100% wide and high, with
z-index: 99999.
__digitalflwrFetchPromise shares the configuration request when the script runs more than once. __digitalflwrIframeCreated stops duplicate frames. The remote response can change the visible lure without another edit to the site.
The compromised page writes the clipboard
The iframe sends its parent a message event with data.type set to copy and the desired text in data.text. The parent calls navigator.clipboard.writeText. If the Clipboard API is unavailable or refuses, it selects a hidden textarea and uses document.execCommand('copy').
The event handler never checks event.origin. Any frame loaded into that page can send the expected message and ask the parent to copy its text. The visible instructions and copied command both come from the remote frame.
What we see
| Month | New sites |
|---|---|
| September | 1 |
| October | 0 |
| November so far | 0 |
Of the 5 sites recaptured at least 25 days after their first match, 3 were still serving DigitalFlwr (60%). Of the 3 DigitalFlwr sites captured since 25 September, 3 ran WordPress. The family last matched on 13 October.
Checking a site
Search raw page content, the WordPress database, theme files and cached scripts for:
__digitalflwrFetchPromiseor__digitalflwrIframeCreated- a URL passed through
corsproxy.io, followed by aHEADrequest createMainIframebuilding a fixed full-window iframe withz-index: 99999- a message handler that copies
data.textwhendata.type === 'copy' - a hidden-textarea fallback using
document.execCommand('copy')
Compare theme JavaScript with a trusted copy and purge page and CDN caches after removal.