ProxySig ClickFix kit

ProxySig retrieves code through a same-origin contract relay and executes the Base64 response. We have matched it on 100 sites since 10 August.

Research by Kirk

ProxySig in numbers

Since 10 August, the first ProxySig match in our records, counted on 12 November 2026. How we count.

Sites with ProxySig code	100
Sites with a match in the last 30 days	22
New sites in October	27
Still serving it when recaptured at least 25 days later	23 of 42 sites (55%)
Sites running WordPress (captured since 25 September)	50%

A contract call behind the site's own URL

ProxySig is a loader that sends a JSON request to /__rpc_proxy__ on the compromised site's origin. The body contains a BNB Smart Chain testnet contract address and selector 0x6d4ce63c. The site handles the blockchain request, so the visitor's browser contacts a familiar origin instead of a public RPC service.

ProxySig reads the same contracts as DoubleDonut.

The returned signature becomes code

The relay replies with a JSON property named signature. ProxySig decodes that value with atob, assigns the result to a new script element and adds it to the document. The loader appears inside ordinary pages and hosting error documents, including responses from a failed origin.

The decoded script applies visitor gates and requests another script. September captures use a randomised /jsrepo path with a timestamp and random value. October builds add a Windows check, skip pages with the WordPress admin bar and preconnect to the script host. A later October copy changes the request to the fixed path /js/my. Both forms retry the request and add the returned script to the page.

What we see

Month	New sites
September	59
October	27
November so far	0

The persistence check found ProxySig again on 23 of 42 sites recaptured at least 25 days after their first match (55%). 50% of ProxySig sites captured since 25 September run WordPress.

89 ProxySig sites also carry DoubleDonut.

Checking a site

Search raw responses and site routes for:

POST requests to /__rpc_proxy__
a JSON body with contract and method fields
a signature response passed to atob
decoded text assigned to a new script element
the Windows and wpadminbar gates in the decoded stage
randomised /jsrepo or fixed /js/my script requests
both injection paths on sites that also carry DoubleDonut

Include error responses in the review. Matches occur in edge-generated and hosting error documents as well as ordinary pages.