TestnetTail ClickFix kit

A loader inside a data URI

TestnetTail is a loader that arrives in the infected page as a script whose source starts data:text/javascript;base64,. Decoding that value produces the complete loader. The browser does not request a JavaScript file from the attacker, so the page source is the place to find it.

Our September copies came from WordPress page HTML. A later build grew and changed its obfuscation and variable names. Both builds use the same contract, selector, cookie and HTML insertion flow.

The contract supplies the host

The loader sends a JSON-RPC eth_call to BNB Smart Chain testnet with selector 0x6d4ce63c. It converts the hexadecimal reply to a byte array, reads the ABI offset and string length, then turns the following bytes into a hostname with String.fromCharCode.

The infected site keeps the contract address. Changing the string in that contract moves the source of the HTML without another edit to the site.

The response becomes page markup

Before making either request, the loader checks for cookie-captcha-complete. A visitor with that cookie skips the loader.

Everyone else follows this path:

1. The browser asks the contract for the current hostname.
2. It fetches https://<hostname> as text.
3. A non-empty response is appended to the end of the infected page with insertAdjacentHTML("beforeend", ...).
4. An empty response sets cookie-captcha-complete=1 for one year.

The cookie lets the operator stop showing the inserted page to a browser after an empty reply.

What we see

Month	New sites
September	2
October	0
November so far	0

Checking a site

Search the server-delivered HTML for a data:text/javascript;base64, script. Decode the value offline and look for this combination:

• an eth_call using selector 0x6d4ce63c
• a request to a BNB Smart Chain testnet RPC service
• manual ABI string decoding with Uint8Array, slice and String.fromCharCode
• cookie-captcha-complete beside insertAdjacentHTML("beforeend", ...)

Check the browser's cookies and network log as well. Remove the injected script, purge page and CDN caches, then clear the completion cookie before testing again.