StatusTail ClickFix kit

The snippet hides its own controls

StatusTail sits in captured WordPress HTML as a script named get_api_key_jss, beside markup produced by WPCode. The first build adds CSS that hides the WPCode menu, admin-bar item and plugin row. A later build replaces that with a timer that removes six WPCode selectors every 300 milliseconds, including both the menu and the plugin cards.

This placement leaves the lure in the site's normal page response and hides the WordPress controls an owner would use to find and disable the snippet.

One ID follows the visitor

The script hashes the page hostname with SHA-256 and keeps the first eight hexadecimal characters. It creates a browser UUID, removes the hyphens, keeps its first eight characters in short_user_id local storage and joins the two values as <site>-<visitor>.

That ID follows three events:

1. captcha_opened when the visitor opens the fake reCAPTCHA.
2. captcha_solved after the image-selection step.
3. command_confirmed after the controller says the command step completed.

The final button checks /cdn/check?id=<ID>. Status reports go to /cdn/verify through sendBeacon or fetch. A completed response sets _verify_<ID> in local storage and reloads the page, so the lure can recognise the same browser later.

The gate changed with the command builder

The first build waits five seconds, accepts Windows visitors and calculates a virtual-machine score from the WebGL renderer, user agent, CPU count, memory and a timing loop. A score of four or more removes the script without showing the challenge.

The later build removes that virtual-machine test and keeps the Windows gate. Clicking the checkbox writes a hidden-window PowerShell command to the clipboard and reports captcha_opened. The visible flow then moves from a fake image challenge to "Quick Command to Continue" and Win+R instructions.

Its generateRandomPS function builds several randomized command forms, shuffles variable assignments and chooses between window styles. It discards that work and always returns one fixed pattern:

powershell -w h -c "[reverse the per-visitor URL]; [download its text]; iex [that text]"

The URL ends in /gd?id=<site>-<visitor>, so the controller can tie the command request to the browser that opened and solved the lure.

What we see

Month	New sites
September	11
October	1
November so far	0

Of the 6 sites recaptured at least 25 days after their first match, 2 were still serving StatusTail. Of the 7 StatusTail sites captured since 25 September, 7 ran WordPress.

Checking a site

Search the server response, WordPress snippets and database for:

• a get_api_key_jss script near wpcode-css-snippet
• code that hides or repeatedly removes WPCode menu, admin-bar and plugin-card selectors
• short_user_id, getShortDomainId and an ID built from two eight-character values
• captcha_opened, captcha_solved, command_confirmed, /cdn/check?id= and /cdn/verify
• generateRandomPS followed by a fixed returned command
• a reversed .workers.dev/gd?id= string in the page source

Check the response while logged out. The WordPress admin view is one of the places this kit tries to clean up after itself.