Stop the attack in the browser. Understand it in one screen.

Stopped at the paste Free and every plan

ClickFix attacks talk people into pasting a command into Run, a terminal or the File Explorer address bar. By the time an endpoint tool sees PowerShell start, the user has already done the attacker’s work. ByteMantle reads every way a page can write to the clipboard, de-obfuscates the text, matches it against 92 command rules for Windows, macOS and Linux and replaces it with a harmless message — nothing is left to paste.

• Your benefit: the most common way into companies today is closed at the one moment it can be closed, with no change to how people work.
• Evidence, not noise: the decoded command, the rules, the MITRE techniques and the site that served it — the commands developers copy every day stay quiet.

How ClickFix works and how we stop it →

Identity phishing Pro and up

Device Code phishing, adversary-in-the-middle kits for Microsoft and ten more identity providers, browser-in-the-browser windows, pages built in memory and sign-in forms on brand-new domains — also those without a password field (e-mail first, one-time code, QR).

• Your benefit: the sign-in your people trust is the one attackers copy. ByteMantle recognises the copy by how it is built and where it is served from, not by a list that is always a day late.

Device Code phishing explained → · Phishing pages →

The whole attack story Pro and up

Every incident opens with the story of what happened, in order: where the user came from (a search, web mail, another site, a typed address), the redirects that led to the page, the site and how old it is, which script loaded which — the page’s script that pulled in the attacker’s — the lure, the command, and how it ended.

• Your benefit: one screen answers the questions management and auditors ask — how did it start, how far did it go, was it stopped — without hours of digging through logs.
• Sixteen real-time correlation rules join the signals of one tab and site into one verdict, each mapped to MITRE ATT&CK.

Investigation graph & campaigns Pro and up

The investigation graph shows, around any site, device, incident, command or indicator, everything it is connected to: the sites a page loads and redirects to, the scripts that load other scripts, the devices that met it, the commands it wrote and where they download from. One click expands the next step.

• Campaigns and the campaign map: sites that share the same smart contract, payload host, Firebase project, worker script or decoded loader are grouped into one infrastructure, drawn as a map. One attacker behind ten sites becomes one finding, not ten.
• Your benefit: you see the operation, not the single page — and block it once.
• The graph exports as JSON, a drawing (SVG) or a STIX 2.1 bundle for your threat-intelligence platform.

Technology & Exposure Enterprise

Your people work every day on suppliers’ portals, shops and SaaS sites you do not control. With Technology & Exposure on, the browsers report the software and versions those sites announce — web servers, languages, content management systems and their plugins, JavaScript frameworks and libraries — and the console matches them with known vulnerabilities, the vulnerabilities known to be exploited in the wild and end-of-support dates.

• Your benefit: know which of the sites your company depends on run outdated or exposed software, and who used them recently — before an attacker uses them against you.
• Check an advisory: when a new vulnerability is announced, see in seconds which sites your people use report an affected version, without a new scan.
• Honest wording: reported versions and possible vulnerabilities, with distribution builds marked — a decision aid, never a false verdict.

Service workers Every console plan

A malicious site can leave a service worker behind that keeps running after the tab is closed and serves the lure again later. ByteMantle scores each site’s workers and removes the suspicious ones — from the browser, or from the console for one browser, a group or every browser that met the worker.

• Your benefit: the attack does not come back next week from a browser you thought was clean.

Intelligence & Artifacts Pro and up

• Intelligence: every site your browsers meet, scored with its age, its links to other sites, the devices that saw it and your team’s verdicts.
• Artifacts: the fingerprints (SHA-256) of commands, scripts and evidence, with how many devices and sites they appear on.
• Your benefit: your own threat intelligence, built from what really reached your people.

Web3 & EtherHiding Enterprise

Attackers hide the address of their next stage in a smart contract, so it cannot be taken down. ByteMantle sees a page that reads a contract without any wallet activity and gets a web address back — the technique behind thousands of compromised sites serving ClickFix — and joins it to the lure and the clipboard. Risky wallet requests (unlimited approvals, permits, blind signatures) are decoded and recorded; contract intelligence covers seven chains.

EtherHiding explained →

Your AI, working on real cases Pro and up

Many teams now use an AI assistant to triage incidents, write summaries for management or decide the next step. ByteMantle gives it a case it can actually reason about — and keeps it safe while doing so.

• One incident, ready for an AI: the summary and verdict, the attack story, the timeline, every event with the rule that matched and why, the decoded command, where the user came from and the redirects, the scripts that loaded other scripts, the site’s intelligence, the campaign it belongs to, the graph and your team’s notes.
• Safe by construction: everything the attacker wrote — commands, page text, addresses — is fenced and labelled as untrusted data, never as instructions, so a page cannot steer your assistant (prompt injection).
• Private on request: user names, device names, host names, e-mail addresses and URL parameters are masked; the raw evidence is included only if you choose. Each export carries your classification label and is written to the audit log.
• Rule analysis for tuning: one line per event with what each rule matched and what your analysts decided, so an AI can help you find and remove false alarms.
• Read API Enterprise: your own AI agents query incidents, events and intelligence directly, with scoped, rate-limited keys.

How it fits together: the extension sees and stops the attack where it happens; the console joins what every browser saw into one case; your AI turns that case into the triage, the summary or the hunting question your team needs. Each part does what it is best at.

SIEM, STIX & reports

• SIEM forwarding Pro and up: events to Splunk (HEC), as CEF lines, or as JSON to any HTTPS webhook (Elastic, Microsoft Sentinel through Logic Apps). The copy is minimized: evidence travels as a SHA-256, never as text.
• STIX 2.1 Pro and up: incidents and graphs as standard bundles with TLP marking, for MISP, OpenCTI and your SIEM’s threat-intelligence store.
• Incident reports Pro and up: PDF with the attack story and the graph, structured JSON, or a ZIP with SHA-256 checksums for the chain of custody.
• Dashboards and scheduled PDF reports Business and up by e-mail, and every list exports to CSV.
• Your benefit: ByteMantle fits into the tools your team already watches instead of adding one more screen.

Your organisation in control Business and up

• One signed policy per organisation or group, in every plan with a console: every protection set to Active, Monitor or Disabled, internal domains exempt from the new-domain checks.
• Your own warning page: your title, message, logo and help-desk contact, which buttons users may press, and a one-click Report to IT.
• Threat indicators and blocking: our signed indicator lists reach every browser automatically; add your own domains, addresses and file hashes, and block a site for everyone in one click.
• Resource Lineage: the third-party resources your pages load, for investigations — off until your organisation turns it on.
• Notices from us in the console: releases, security advisories and maintenance reach your administrators where they work.
• For providers: a provider console for MSPs that manage many client organisations.

Why this combination

Large security suites see the network or the endpoint; browser products often stop at blocking a page. ByteMantle brings together what usually takes several products and a long project:

Built secure, private by design

• Every browser has its own non-exportable key and signs every request; rules, policies, licences and console commands are signed and checked before the extension acts.
• Two-step sign-in, viewer / analyst / admin roles, a full audit log and sign-in limited to your networks or countries.
• Detection runs locally and keeps working offline; nothing is sent unless you or your organisation connect the browser. Evidence is minimized by default.

What we collect — and what we don’t →

Labs & roadmap

Not generally available yet, shown for transparency: extension risk control, download protection and data-leak protection for uploads and AI prompts, corporate password reuse protection, external reputation feeds.