ClickFix report: 32 hacked sites, 11 smart contracts behind them.

Want your browsers to stop this at the paste? The ByteMantle extension reads every command a page puts on the clipboard and replaces a dangerous one before you can paste it. Get the extension — free.

The numbers

Not counted: 10 more pages where only the page scan saw lure wording, with no command and no contract read. Some of them are articles and videos about ClickFix, so we do not call them hacked.

Since the last report (2026-11-02 – 2026-11-05)

• Sites with a lure: 32 (last time 38); with a command on the clipboard: 22 (last time 28).
• Last time every page with lure wording was counted; since this report a site counts only with evidence of the attack on it (a command, a contract read or a confirmed lure), so the numbers are not directly comparable.
• Smart contracts: 4 new, 7 still in use, 1 not seen this time.
• Attacker domains: 9 new, 9 seen again.

The hacked sites and what they run

The lures are on real websites of real organisations, with a script added that draws a fake "Verify you are human" box over the real page. Our browsers record the software each site reports about itself.

This does not say how each site was broken into: stolen passwords and vulnerable plugins are just as common. It says that the sites hosting these lures were often not well looked after.

The smart contracts behind the lures

On 22 sites the added script asks a smart contract on a public blockchain where the lure is, every time the page loads (EtherHiding). The attackers change one value and every hacked site shows the new lure; nobody can take a contract down.

4 site(s) read more than one contract, so the column adds up to 26 for 22 sites.

How it connects

The same contract means the same operation. Following each contract to the sites that read it, and from there to what their commands download, shows separate campaigns with their own habits — the way the investigation graph in the ByteMantle console shows it for your own browsers.

• The biggest operation (Polygon contract 0xb6bc…c1f2, 6 sites): lepafonso[.]bz, codes.browse-cdn[.]beer; PowerShell: download and run.

Where the commands download from

For security teams: blocking these services is not an option, and the attackers' own addresses change weekly. What does not change is the shape of the command: a shell, a download, an execution, put on the clipboard by a web page.

The commands, by form

The attackers' domains

The download servers and lure servers that belong to the attackers themselves: 18 this time. Half of those with a known registration date are younger than 12 days. The registration date of 2 of them is not known to the console yet.

New this time

• One contract, a new download server every few days. The busiest Polygon contract pointed to a domain registered 13 hours before its first use, then to a second one registered two days before. How it works.
• The visitor is reported before the download. Five hacked sites served the same command, which first sends an id, the Windows version and the hacked site to one Google Apps Script project. The beacon.
• Six ways past irm | iex. A shared network drive, a silent installer, an executable in Temp, an HTML application, encoded layers and a public code CDN. The six methods.
• A fake "Claude early access" page again, on a domain registered about a month before: AI tools remain a favourite bait.

How to protect your people and your site

• Tell your people the one rule: no real website ever asks you to press Windows + R, open Terminal or paste something to prove you are human.
• Stop it at the paste. ByteMantle reads what a page puts on the clipboard, recognises the command by its shape (not by its domain) and replaces it with a harmless message.
• Run a website? Keep the CMS, its plugins and PHP up to date. Open your own site with the ByteMantle extension: a lure or a contract read on your own pages means it was hacked. Our SC research explains how to check and clean.

Indicators

For your SIEM or threat-intelligence platform:

• Indicators (CSV)
• Indicators (STIX 2.1)
• Sites that served the lure (CSV)
• Sites that served the lure (STIX 2.1)

The two "Sites that served the lure" lists name the 31 hacked sites and the 5 lure pages the attackers registered themselves, with the exact address and the dates we saw each one (1 site of a private person is counted but not listed). A site is listed because it served the lure when our research browsers opened it: the owner may have cleaned it since. The lists come only from ByteMantle's research browsers, never from what our customers' browsers see.

Own one of these sites? Check and clean it (our SC research explains how), then write to info@bytemantle.com and we update the list.

How we collect this

We open pages from a public list of ClickFix sites in research browsers with the ByteMantle extension, the same extension you can install. We do not run the commands and do not download the malware. Every number comes from the ByteMantle console's threat report for those browsers: what the extension recorded on the pages, and what the console knows about the software and known flaws of the sites (NVD, OSV, CISA KEV, endoflife.date). A site counts once, however many times we opened it.