ScanMalware.com
Known malicious kitcriticalphishing

ClearFake / ClickFix 'enterprise2026' cluster — bscSl fake WordPress plugin loader (hunting rule)

family: clearfake-enterprise26-2026-08
Short link:scanmalware.com/h/210

Content match for the first stage on compromised WordPress sites: the fake plugin script bsc-loader.js (guard window.__bscSlRan) or the settings object WordPress prints for it, var bscSl = {ajaxUrl, nonce, action: "bsc_sl_get_script"}. The loader POSTs to the site's admin-ajax endpoint and injects the returned EtherHiding contract reader.

Anchors

Hunting ruleClearFake_BscSl_WordPress_Plugin_Loader

Provenance

Added: 2026-09-25 12:24
Survives the per-site plugin rename (seen as modula-gallery-68 and exactmetrics-pro-2) because it keys on content, not path. The bsc_sl_get_script action name alone is sufficient; the other strings require at least two properties of the settings object together. Complements the exact-hash row, which only catches byte-identical copies.
References:

Sightings (18)Atom feed

HostScanScriptMatchScanned
alssada.org80be4059…https://alssada.org/wp-content/plugins/fast-cache-34/js/bsc-loader.js?ver=1.6.5rule2026-11-10 01:47
alssada.org#html80be4059…https://alssada.org#htmlrule2026-11-10 01:47
alssada.org80be4059…https://alssada.org/rule2026-11-10 01:47
www.szhyxdz.com0f9710ac…https://www.szhyxdz.com/wp-content/plugins/klaviyo-pro-48/js/bsc-loader.js?ver=3.3.2rule2026-11-08 12:48
szhyxdz.com#html0f9710ac…https://szhyxdz.com#htmlrule2026-11-08 12:48
www.szhyxdz.com0f9710ac…https://www.szhyxdz.com/rule2026-11-08 12:48
safespacio.com0d5d43d8…https://safespacio.com/wp-content/plugins/exactmetrics-pro-29/js/bsc-loader.js?ver=2.5.2rule2026-10-29 08:47
safespacio.com#html0d5d43d8…https://safespacio.com#htmlrule2026-10-29 08:47
safespacio.com0d5d43d8…https://safespacio.com/rule2026-10-29 08:47
www.novohair.sea8e082c7…https://www.novohair.se/wp-content/plugins/monsterinsights-pro-3/js/bsc-loader.js?ver=3.8.4rule2026-10-28 23:40
novohair.se#htmla8e082c7…https://novohair.se#htmlrule2026-10-28 23:40
www.novohair.sea8e082c7…https://www.novohair.se/rule2026-10-28 23:40
musedesignstaging.com09c0229a…https://musedesignstaging.com/wp-content/plugins/ninja-forms-101/js/bsc-loader.js?ver=3.0.8rule2026-10-17 16:51
musedesignstaging.com#html09c0229a…https://musedesignstaging.com#htmlrule2026-10-17 16:51
musedesignstaging.com09c0229a…https://musedesignstaging.com/rule2026-10-17 16:51
rcrsinnovations.com#htmlb898f2e3…https://rcrsinnovations.com#htmlrule2026-09-25 12:02
rcrsinnovations.come7aa41f1…http://rcrsinnovations.com/wp-content/plugins/exactmetrics-pro-2/js/bsc-loader.js#htmlrule2026-09-12 22:48
osmilano.it#html99e574cc…https://osmilano.it#htmlrule2026-08-26 16:10