JokerStat ClickFix kit
JokerStat is a ClickFix tracker and loader that records page activity, sends screenshots and runs browser code returned by its controller. We have matched it on 9 sites since 28 August.
JokerStat in numbers
Since 28 August, the first JokerStat match in our records, counted on 12 November 2026. How we count.
| Sites with JokerStat code | 9 |
|---|---|
| Sites with a match in the last 30 days | 1 |
| New sites in October | 0 |
| Sites running WordPress (captured since 25 September) | 0% |
The JokerStat browser tracker
The downstream script identifies itself as JokerStat Analytics Tracker v1.0.0. Palo Alto Networks Unit 42 published the campaign under that name in July 2026 after finding more than 130 compromised WordPress sites. Its report describes a fake CAPTCHA delivered after the tracker has resolved its controller (Unit 42).
The tracker we recovered is the same browser component. It records page views and session activity, takes screenshots and asks the controller for JavaScript to run on the page.
The wrapper changes, the resolver stays
JokerStat arrives as an inline Base64 string under a one-byte XOR layer. The wrapper decodes it into a byte array, turns the bytes into text and passes the result to new Function. A WordPress capture held repeated copies between wpmbchik comments, all using XOR key 212. A later Magento capture dropped the comments, changed every variable name and used key 68.
Both wrappers reveal the same resolver. It queries a DNS TXT record over HTTPS, XOR-decodes each answer with 0x4B and chooses one returned address. If that query fails, it reads a GitHub-hosted fallback. It then adds tracker.js to the page with a data-site-key attribute. Changing the TXT record or fallback moves the tracker without another edit to the compromised site.
What the tracker records
The script ignores automated browsers before it starts. For other visitors it creates a session ID and reports the page URL, referrer, screen size and any utm_source, utm_medium or utm_campaign values. It sends a heartbeat every 15 seconds and reports time spent on the previous page when navigation changes.
Screenshots start as soon as the tracker loads. It imports html2canvas, renders the visible page at half scale and sends a JPEG to /collect/screen, then repeats every two minutes. The request includes the site key and current page address.
The tasking request goes to /cload with the site key, operating system and current hostname. Any non-empty JavaScript response is appended to the document and runs in the compromised page. Unit 42 observed that response producing the fake CAPTCHA and personalized clipboard step in this campaign.
What we see
| Month | New sites |
|---|---|
| September | 8 |
| October | 0 |
| November so far | 0 |
Of the 3 JokerStat sites captured since 25 September, 0 ran WordPress. The family last matched on 13 October.
Checking a site
Search raw page source, templates and deployed JavaScript for:
JokerStat Analytics Tracker v1.0.0wpmbchikcomments around a Base64 string, a one-byte XOR loop andnew Function- a DNS-over-HTTPS TXT lookup followed by a
tracker.jselement withdata-site-key - requests to
/collect,/collect/heartbeat,/collect/screenor/cload?k=on a host you do not recognise - the session-storage keys
js_sid,js_prevandjs_prev_t
Check Magento templates as well as WordPress files. The wrapper does not need the wpmbchik marker.