TripleGnaw ClickFix kit

A loader packed with three repeating keys

TripleGnaw is a loader built around three repeating keys and four byte operations. Its strings are long runs of dot-separated base-36 numbers, and even DOM method names are split into fragments such as crea + teEle + ment.

The first capture carried the loader inline in the document. A later WordPress capture kept the same decoder but replaced the three keys, the encoded number streams and the generated variable names. The browser still followed the same route: decode each packed script and run it from a temporary Blob URL.

Four operations before execution

Each base-36 word becomes one byte through a fixed sequence:

1. XOR it with a byte from the first repeating key.
2. Rotate it right by three bits.
3. Subtract its position multiplied by a byte from the third key, modulo 256.
4. XOR it with a byte from the second key.

TextDecoder turns the resulting byte array into JavaScript. The loader creates a script element through native DOM prototypes, points it at a Blob URL and removes that element after it loads. Repacked copies look unrelated at a glance because the keys, numbers and identifiers all change.

Contract first, WebSocket second

The decoded resolver sends eth_call with selector 0x57de26a4 to a contract on BNB Smart Chain testnet. It hex-decodes the reply, takes the Base64 text between # delimiters and runs the decoded JavaScript. The contract result is kept in sr_gwcache.

That script opens a WebSocket. Its query carries the current page path, a browser ID stored as __cl_gw and an operator ID. Messages arrive as /* event.key:payload */. An init payload is Base64-decoded, URI-decoded and XORed with the supplied key. If the result is a URL, TripleGnaw loads it as a script; otherwise it runs the result from another Blob.

What we see

Month	New sites
September	3
October	2
November so far	0

Of the 1 TripleGnaw sites captured since 25 September, 1 ran WordPress.

Checking a site

Search raw HTML and cached page output for:

• a long dot-separated number stream parsed with radix 36
• three repeating strings used through charCodeAt, with a three-bit rotation between the XOR steps
• split DOM names such as crea + teEle + ment and crea + teObj + ectU + RL
• selector 0x57de26a4 or storage keys sr_gwcache and __cl_gw
• WebSocket messages wrapped as /* event.key:payload */

Purge WordPress optimisation caches after removing the injected script. Cached page output can preserve a packed copy.