# ByteMantle

> ByteMantle is a browser detection and response platform for organisations and individuals. A browser extension for Chrome and Edge
> stops browser attacks before anything runs (ClickFix and fake CAPTCHA commands, phishing, Device Code phishing, EtherHiding,
> malicious service workers), with detection running locally. A console (EU-hosted or self-hosted) gives a security team every attack
> as one incident with its whole chain, the technology and exposure of the sites its people use, signed policies, and integrations with
> SIEM, ServiceNow and a Read API. Core protection is free for one browser; Pro, Business and Enterprise plans add the console features.

## Product
- [Platform](https://bytemantle.com/platform/): the eight layers of protection and how attacks are correlated into incidents
- [For home](https://bytemantle.com/home/): free protection for your own browser
- [For Business](https://bytemantle.com/business/): the console, policies, deployment with Group Policy, Intune or Google Admin
- [Enterprise](https://bytemantle.com/enterprise/): Technology & Exposure of the sites your people use, supplier risk, NIS2 / DORA register, SaaS inventory, integrations
- [For MSPs](https://bytemantle.com/msp/): managing many organisations
- [Plans](https://bytemantle.com/pricing/): what each plan includes
- [Trust & Privacy](https://bytemantle.com/trust/): what leaves the browser, data minimisation, hosting

## Documentation
- [Docs](https://bytemantle.com/docs/): install, deploy to an organisation, connect a browser to a console
- [API and integrations guide](https://bytemantle.com/docs/api/): SIEM forwarding (Splunk, Elastic, Microsoft Sentinel, CEF), ServiceNow, the Read API, recipes with tested examples, complete reference
- [Changelog](https://bytemantle.com/changelog/): what changed in each release

## Threats it protects against
- [ClickFix and FileFix](https://bytemantle.com/threats/clickfix/)
- [Device Code phishing](https://bytemantle.com/threats/device-code-phishing/)
- [Phishing](https://bytemantle.com/threats/phishing/)
- [EtherHiding](https://bytemantle.com/threats/etherhiding/)

## Research
- [Research and guides](https://bytemantle.com/research/): how today's browser attacks work, and our own research
- [Give your AI assistant the incident, not the attacker's instructions](https://bytemantle.com/research/ai-incident-export-prompt-injection/): Browser incidents are full of text the attacker wrote. Pasted into an AI assistant, it becomes prompt injection. What a safe incident export looks like, and how ByteMantle prepares one.
- [AiTM phishing: you passed MFA. So did the attacker.](https://bytemantle.com/research/aitm-phishing-mfa-bypass/): Adversary-in-the-middle phishing kits proxy the real Microsoft sign-in, relay your MFA and steal the session cookie. How they work and what actually stops them.
- [Browser-in-the-Browser phishing: the sign-in window that isn't a window](https://bytemantle.com/research/browser-in-the-browser-phishing/): A Browser-in-the-Browser page draws a fake Chrome pop-up with a real-looking address bar and puts the attacker's sign-in form inside. How it works, how to tell it apart in seconds, and what actually stops it.
- [Chrome now warns about ClickFix. Is that enough?](https://bytemantle.com/research/chrome-clickfix-warning-vs-extension/): Chrome now warns Enhanced Protection users about some copied ClickFix commands. What it covers, what it sends to Google, and what a browser security extension adds.
- [The ClickFix beacon: how a fake CAPTCHA reports you before the download](https://bytemantle.com/research/clickfix-beacon-fake-captcha-profiles-you/): Five hacked websites served the same ClickFix command: before downloading anything, it reports the visitor, the Windows version and the hacked site to one Google Apps Script project. What ByteMantle research browsers saw, 5–11 November 2026.
- [ClickFix report: 38 hacked sites, 2–5 November 2026](https://bytemantle.com/research/clickfix-report-2026-11-05/): What ByteMantle research browsers met on live ClickFix pages, 2–5 November 2026: 38 hacked sites, 25 lures read from 8 smart contracts, the commands and where they download from.
- [ClickFix report: 32 hacked sites, 5–11 November 2026](https://bytemantle.com/research/clickfix-report-2026-11-11/): What ByteMantle research browsers met on live ClickFix pages, 5–11 November 2026: 32 hacked sites, 22 lures read from 11 smart contracts, the commands and where they download from.
- [Device code phishing: the real Microsoft page, the wrong person signed in.](https://bytemantle.com/research/device-code-phishing-microsoft-365/): Attackers ask you to enter a code on the real microsoft.com/devicelogin page and take over your Microsoft 365 account, MFA included. How to spot and stop it.
- [EtherHiding: the malware host nobody can take down.](https://bytemantle.com/research/etherhiding-blockchain-malware/): EtherHiding stores malicious code in public blockchain contracts and loads it into hacked websites. Why it cannot be taken down, and how to stop it in the browser.
- [Beyond irm | iex: six ways a fake CAPTCHA delivers malware](https://bytemantle.com/research/fake-captcha-six-delivery-methods/): A network drive, a silent installer named like a Windows update, a program in Temp behind a decoy window, an HTML application, layers of encoding and a public code CDN: the ClickFix commands ByteMantle research browsers met, 5–11 November 2026, and what they have in common.
- [A CAPTCHA asked you to press Windows + R. It is not a CAPTCHA.](https://bytemantle.com/research/fake-captcha-windows-r/): A “verify you are human” page that tells you to press Windows + R and paste is a ClickFix scam. What it does, what to do if you already pasted, and how to stop it.
- [One smart contract, a new payload server every few days](https://bytemantle.com/research/one-smart-contract-new-payload-host/): A Polygon smart contract told hacked websites where to send their visitors: to a domain registered 13 hours before its first use, then to a new one. What ByteMantle research browsers saw, 5–11 November 2026, and why a block list cannot keep up.
- [The WordPress backdoor that keeps its address book on Ethereum](https://bytemantle.com/research/sc-family-wordpress-etherhiding/): A self-healing WordPress backdoor reads its command servers from Ethereum smart contracts, steals admin passwords and plants a service worker. How to check and clean.
- [Your suppliers' exposure, without scanning anyone](https://bytemantle.com/research/supplier-exposure-without-scanning/): The sites your people use already tell their browsers which software they run. How ByteMantle turns that into supplier and SaaS exposure, an exposure score and a NIS2 / DORA register, without scanning anyone.
- [What is ClickFix? The attack your users run for the attacker.](https://bytemantle.com/research/what-is-clickfix/): ClickFix and FileFix make users run malware themselves through Run, PowerShell or Terminal. How the attack works, why defences miss it and how to stop it.
- [What leaves the browser, and what does not](https://bytemantle.com/research/what-leaves-the-browser/): A browser security extension sees everything a page does. What ByteMantle sends to the console, what stays in the browser, and what your organisation decides — data minimisation, explained.
- [Which script loaded the attacker's script?](https://bytemantle.com/research/which-script-loaded-the-attackers-script/): When a site you trust starts serving a fake CAPTCHA, the first question is where the attacker hides in it. The browser saw which script added the attacker's script. How ByteMantle shows that chain to site owners and SOCs.

## Full text
- [Every page of this site as text](https://bytemantle.com/llms-full.txt): the same content as the pages, in one file