PolyTDS ClickFix kit

The contract address sits on the script element

PolyTDS is a large inline loader whose data-contract attribute holds a Polygon contract address. The script reads that attribute, sends an eth_call with selector 0xc3f909d4 and decodes the returned value as a domain. It then builds an HTTPS address ending in /tds/ and injects that address as a script.

The contract value lets the operator change the script host while infected pages keep the same loader.

The /tds/ script presents the visitor with a ClickFix prompt. Its copied command uses msiexec.

The packed loader survived an optimiser rewrite

The original build uses javascript-obfuscator. Its string table carries a swapped-case Base64 alphabet, which hides the Polygon RPC method, selector and /tds/ path in raw source.

September captures contain the same inline build. An October capture shows a WordPress performance optimiser changing the script type and later turning its body into a Base64 data: URL. The data-contract attribute survives that rewrite. Search the final response and decoded data: content as well as the original template.

What we see

Month	New sites
September	2
October	29
November so far	0

PolyTDS matches began on 29 September. 5 sites had a match in the 30 days to 12 November 2026, and 10% of captured PolyTDS sites run WordPress.

Checking a site

Search server responses and decoded scripts for:

• a data-contract attribute holding a Polygon contract address
• an eth_call to Polygon with selector 0xc3f909d4
• a decoded HTTPS script address ending in /tds/
• a large obfuscated string table with a swapped-case Base64 alphabet
• a Base64 data:text/javascript URL carrying the same loader

Trace the injection into templates, database content and optimisation caches, then purge each affected cache before retesting.