ImageGnaw ClickFix kit
ImageGnaw is a packed image-selection lure embedded in a compromised page. We have matched it on 1 site since 16 August.
ImageGnaw in numbers
Since 16 August, the first ImageGnaw match in our records, counted on 12 November 2026. How we count.
| Sites with ImageGnaw code | 1 |
|---|---|
| Sites with a match in the last 30 days | 1 |
| New sites in October | 0 |
| Still serving it when recaptured at least 25 days later | 1 of 1 site (100%) |
| Sites running WordPress (captured since 25 September) | 100% |
The infected page carries its bootstrap
ImageGnaw sits inline in server-delivered WordPress HTML. The visible block is only a small bootstrap: atob decodes a Base64 string, a new script element receives the decoded text through textContent, and document.head.appendChild starts it.
The decoded script keeps its command, page-cleanup routines and challenge loader behind an obfuscated string table. The decoded SHA-256 stayed the same across captures, even though the WordPress page around the injection changed.
It clears the page before the lure arrives
The script removes every iframe already on the page and watches for new iframes with a MutationObserver. It performs a similar sweep over inline scripts: any script whose text contains base64 is removed unless it has ImageGnaw's own my-custom-script ID. A second observer applies that test to scripts added later.
One second after the document is ready, the loader sends the browser's user agent, language and platform to its controller. The reply supplies CSS and HTML. ImageGnaw installs the style in the page head, appends the HTML to the body and binds its click handlers to the returned challenge.
Three images lead to a fake DNS error
The returned HTML begins with a checkbox. Clicking it opens an image-selection popup. Each image click toggles a selected class and changes a counter; selecting exactly three images closes the popup.
ImageGnaw then replaces the challenge with "Verification Failed - Network Error" and claims the visitor's DNS is unstable. At the same moment it copies an mshta https://[remote host]/verification.html command with navigator.clipboard.writeText.
The repair steps are Win+R, Ctrl+V and Enter. The visible instructions show only the keys; the clipboard holds the command.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October | 0 |
| November so far | 0 |
Of the 1 site recaptured at least 25 days after their first match, 1 were still serving ImageGnaw (100%). 100% of ImageGnaw sites captured since 25 September run WordPress. Among those sites, 1 run WooCommerce and 1 run Elementor.
Checking a site
Start with the server-delivered HTML. Search for a script that combines:
atob,document.createElement("script"),textContentanddocument.head.appendChild- an element ID of
my-custom-script - removal of scripts containing
base64, plus removal ofiframeelements - a POST carrying
userAgent,languageandplatform
Decode the Base64 offline. In the result, look for .captcha-images img, a counter that triggers at three selections, Verification Failed - Network Error and a clipboard string beginning with mshta. Purge cached HTML after removing the injection.