Which script loaded the attacker's script? Cleaning a hacked site starts there.
When a legitimate site starts serving a fake CAPTCHA, its owner does not first ask "what was the lure?" but "where is the attacker hiding in my site?". The browser saw the answer, if something was watching.
In short
- A compromised site loads dozens of scripts. One of them adds the attacker's script, and network logs show both requests without saying that one caused the other.
- At the moment a script adds another script to the page, the browser knows which file is running. That link names the file to clean or the plugin to remove.
- ByteMantle records it next to the detection and shows it in the attack story, the investigation graph and every export, STIX 2.1 included.
- Only the address and path of the scripts leave the browser, never their parameters.
The usual picture
A WordPress site or an online shop loads its theme, a dozen plugins, analytics, a chat widget and a content network. Somewhere in that list, one file adds a new script from a domain registered last week, and that script draws the fake "Verify you are human" box. The site's owner sees a long list of requests in the network log and has to guess which of their own files was changed.
What the browser can tell
When a script inserts another <script>, the browser is running a known file at that moment. That link, for example static.example-cdn[.]com/…/loader.js → x.example[.]top/…/stage2.js, is the thread to pull:
- for the site owner, it names the file to clean, the plugin to update or remove, or the third party whose library was poisoned;
- for a security team, the same loader on several sites shows that they belong to one campaign, even when the final lure changes every day.
How ByteMantle uses it
- The attack story of an incident shows "Script loaded a script" next to where the user came from and the redirects before the page.
- The investigation graph draws the link between the two sites, so the same loader on other sites shows up as one campaign.
- Every export carries it: JSON, PDF, the text prepared for an AI assistant and STIX 2.1 for your threat-intelligence platform.
- Private by design: only the address and path of the scripts leave the browser, never their parameters.
Read it as a lead, not a verdict
The page itself reports which file was running, so ByteMantle shows the chain as "reported by the page": the starting point of an investigation, never the reason for a warning. Warnings come from what the page does to the user: the lure, the command it puts on the clipboard, the sign-in form on the wrong domain.
Questions people ask
I own the site. What do I do with the chain?
Open the loader file named in the chain on your server and compare it with a clean copy of your theme or plugin. Remove what was added, update the plugin, change your administrator passwords and check for new administrator accounts.
Does ByteMantle scan the site?
No. It only notes what the browser already did while your people visited the page. No extra request reaches the site.
Read the researchSC: the WordPress backdoor that keeps its servers on Ethereum
Stop these attacks before anything runs.
Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it.