OverlayWar ClickFix kit
OverlayWar is a ClickFix kit that reads its staging host from Polygon contracts and deletes other kits' overlays before showing its own. We have matched it on 4,965 sites since 10 August.
OverlayWar in numbers
Since 10 August, the first OverlayWar match in our records, counted on 12 November 2026. How we count.
| Sites with OverlayWar code | 4,965 |
|---|---|
| Sites with a match in the last 30 days | 2,694 |
| New sites in October | 1,575 |
| Still serving it when recaptured at least 25 days later | 1,651 of 2,210 sites (75%) |
| Sites running WordPress (captured since 25 September) | 95% |
The cleaner script removes rival overlays
OverlayWar injects a cleaner script next to its loader to delete other kits' lures. On every new element, every click, and every 150 milliseconds for the first five seconds after the page loads, it removes any fixed overlay that covers 90% of the screen with a z-index of 9990 or more. It spares only overlays carrying its own token or its cfm marker, plus the WordPress media window, Elementor and the admin bar, so the site still works for its owner.
One of the overlays it removes is DriveSurge's #fkrc-overlay. 440 sites carry both kits.
The cleaner arrives with a settings object named CFG_CONFIG. We find it already rewritten by WP Rocket and LiteSpeed on many sites, which means the code was in WordPress's own page output before the caching plugin processed it.
A PHP dropper clears other kits from the server
Since 8 October 2026 we have read OverlayWar's PHP on 19 sites. It sits in the theme's functions.php between wphc-theme-compat:begin and wphc-theme-compat:end comments. On these sites the server prints the block as text at the top of the page instead of running it, which is how we can read it.
The block writes a must-use plugin, wph-auto-cache.php, titled "Content Cache Support". The plugin stores the loader in a hidden file, .wphc-store.php, prints it in the head of the site, the dashboard and the login page, and puts the theme block back if someone removes it. Every six hours it also switches a Code Snippets entry named content-cache-support back on.
The plugin carries a list of other kits' markers, among them LenAI's Polygon contract, its b68d1809 selector, its interseq[.]at controller and api.php?s=. It strips any script, frame, meta or link tag that carries one from each page before the page is sent. Every six hours it cleans the markers out of theme files, posts and Code Snippets entries, and renames must-use and ordinary plugins that carry them, deactivating the plugins first. It renames advanced-cache.php so a page cache cannot serve old copies ahead of it, then empties the caches of the common caching plugins.
On the three sites we read, it also deletes every WordPress user except one login written into the plugin, and permanently deletes the posts those users wrote. It does this once.
From a contract to a staging host
The loader is built around three functions, getServers, tryLoadScript and createDeferredScript. It skips bots and anything that is not Windows, then sends an eth_call to a Polygon contract, using one of two selectors, 0x3bc5de30 or 0xf8d1f123.
The reply is encoded three different ways depending on the build: hyphenated hex with a position offset, base-36 pairs, or a custom Base64 alphabet XORed with a key that grows by 137 at each position. Each contract is bound to its own key. The decoded value is one staging host or a list of them, and the loader keeps its choice in window.currentServer and loads /get_script or /js/all.min.js from it, trying twice, three and then six seconds apart.
On one contract we watched the stored value change to something the old loader's key could no longer decode, while infected sites kept serving the old loader. Sites carrying that old build stop loading the lure until they are reinfected.
A site infected twice can break itself the same way. Each loader declares a global decode(token, key) function, and the copy that loads last replaces the other. On one site the second loader's contract value went through the first loader's key, and the page requested a garbled script path beside the hosts that worked.
The lure and the command
While the stage loads, the page shows a full-screen spinner. Its random id doubles as the cleaner's token, so the cleaner never removes its own kit. Almost every site we have seen uses one of these recurring tokens: uS1j3xMa60p9uwhK, l98luimoo7724mcv and ckrj3vw143eg5hip.
The lure is a fake Cloudflare check with the #cfm marker, served from the staging host. It explains the steps in 18 languages: Win+X, then I to open Terminal, then Ctrl+V and Enter. It asks the controller for the command at its first_allow_host endpoint and fills in the visitor's server, ID and Ray ID before copying it.
The commands we captured are PowerShell dressed up as Cloudflare verification. They download a ZIP file from a get_verify path, hide it, and add a Run key under the current user so it starts again at every logon.
What we see
| Month | New sites |
|---|---|
| September | 2,309 |
| October | 1,575 |
| November so far | 199 |
Of the 2,210 sites recaptured at least 25 days after their first match, 1,651 were still serving OverlayWar (75%). 95% of OverlayWar sites captured since 25 September run WordPress.
Checking a site
Look in the page source for:
- inline code with functions named
getServers,tryLoadScriptandcreateDeferredScript - a settings object called
CFG_CONFIG - one of the spinner ids above
- requests to
/get_scriptor/js/all.min.json a host you do not recognise wphc-theme-compatcomments in the theme'sfunctions.php, orwph-auto-cache.phpor.wphc-store.phpinwp-content/mu-plugins/- plugin files or
advanced-cache.phprenamed with a.wphc-offending
If the PHP dropper ran, compare the user list and the posts with a backup: it deletes every account but one.
On a Windows machine, a Run key you did not create under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run after a "verification" is a sign the command ran.
Contracts we read
We read 19 OverlayWar contracts every day.
| Chain | Contract | Current destinations | Last changed |
|---|---|---|---|
| Polygon | 0x161bc15e5fc5544aa52f67e9bce1316b76855e25 | ingestlabapp[.]com, telemetryspace[.]com | |
| Polygon | 0x1BA37423ca3bb5F7836d2F3Fb00B8b0D7761c2CA | cloudredirect[.]online, webpagesafe[.]online | |
| Polygon | 0x31be3fbbbc539191f4b597ddddad1177363b741d | updateocean[.]com | |
| Polygon | 0x352546bb99c9f0016af72ed658b13467667e1498 | redirectwebpage[.]online, unavailablerobot[.]online | |
| Polygon | 0x4599008ac76f2e4b655499b5d2bd61758ec7eca4 | cloudyredirect[.]online, webpageclouds[.]online | |
| Polygon | 0x474d0577972b8f2bac6e5f43dac67bddc3061266 | heartbeatyardpoint[.]com, ingestwebneo[.]com | |
| Polygon | 0x4b00eadff1553ea2773b9fb2c29d987ae397863b | errorsyshub[.]com, insightpingbot[.]com, licensesyqlink[.]net | |
| Polygon | 0x5e03dab7c4e71e9f6efb0e7a156f4e663b0e95c6 | admetricslab[.]org, soft-update[.]dev | |
| Polygon | 0x62ee1bde79e3cf8d2299f07d8e58ca58f24727af | benotrobot[.]online, cloudyrobots[.]online | |
| Polygon | 0x6e65583c3c3cc0063215cb93de137e2da1513bfd | infodatalis[.]com, telemetryloop[.]net, ukwearstore[.]org | |
| Polygon | 0x8ecb2d418199994b8132de48645bd9e5178342c4 | bestcloudservicesupport[.]com, bestguardservicesupport[.]com, bigdealjournal[.]com | |
| Polygon | 0x91639826046fd209ef96c76cf9089e6dde2d408a | authshipup[.]net, runtimerailbit[.]com, servicestatlab[.]com | |
| Polygon | 0xa1cb583820efe60c840498aada3f741ab6869cbe | assetwaveapp[.]com, bannerware[.]net, trackbaseneo[.]net | |
| Polygon | 0xbf208ee70de2b68debffaa740e190ed76fbe3b4c | casinodas[.]com, mathandchessss[.]com, sex-reputation[.]com | |
| Polygon | 0xc1c992a4f243F59Db6c5B6e4Cac9CBc27dC4011A | humanwebpage[.]online, sunnycloud[.]online | |
| Polygon | 0xc35b4bcd70b17a6347f6f139ced95daf62dceb08 | benotrobot[.]online, cloudyrobots[.]online | |
| Polygon | 0xcf088bd3c86602a7a1e31d5fdb8a71652596db49 | fish-planet[.]online, online-park[.]online | |
| Polygon | 0xeE887090781621b444f5ccf887127D6e128B4Ce3 | matrixs1[.]eastus[.]cloudapp[.]azure[.]com, softix[.]eastus[.]cloudapp[.]azure[.]com | |
| Polygon | 0xf5966808a9ECbdb8794F568922809C52b0Fd2446 | besthappyfamily[.]com, goodpersonofourcentury[.]com, waysmakeyourlifebetter[.]com |
The EtherHiding contract tracker keeps the full destination history.
Hosts its commands download from
OverlayWar lure commands we captured download from 20 hosts. These are the 10 on the most sites.
| Host | Sites | Last seen | Latest command |
|---|---|---|---|
humanwebpage[.]online | 55 | CommandURL First seen 3 October 2026, 83 URLs on this host. | |
cloudredirect[.]online | 34 | CommandURL First seen 3 October 2026, 70 URLs on this host. | |
dank-us[.]com | 23 | CommandURL First seen 6 September 2026, 1 URL on this host. | |
webpagesafe[.]online | 23 | CommandURL First seen 29 September 2026, 48 URLs on this host. | |
script-six-tawny[.]vercel[.]app | 22 | CommandURL First seen 26 September 2026, 3 URLs on this host. | |
ld-me[.]sbs | 13 | CommandURL First seen 24 October 2026, 13 URLs on this host. | |
sunnycloud[.]online | 12 | CommandURL First seen 2 October 2026, 26 URLs on this host. | |
unavailablerobot[.]online | 11 | CommandURL First seen 29 September 2026, 24 URLs on this host. | |
www-cf[.]com | 11 | CommandURL First seen 28 September 2026, 11 URLs on this host. | |
webpageclouds[.]online | 9 | CommandURL First seen 13 October 2026, 12 URLs on this host. |
The ClickFix command tracker lists every host.