ScanMalware.com
Known malicious kitcriticalstealer

Macfinger ClickFix — per-site first stage t.js?site= (YARA)

family: macfinger-clickfix-2026-09
Short link:scanmalware.com/h/240

The first-stage script that compromised websites load from a rotating attacker domain as /t.js?site=<32 hex>. Its content differs for every victim site, so it is matched by structure: the analytics and A/B-test globals it sets, together with its references to the content-addressed loader t.<hash>.js and the ext-b fingerprinting stage.

Anchors

YARA ruleClickFix_BotProtection_Loader

Provenance

Added: 2026-10-01 11:33
Detection rule by Ransom-ISAC. Matches the first stage only, not the shared loader or the fingerprinting script, and not look-alike t.js?site= scripts that never load t.<hash>.js and ext-b.
References:

Sightings (124)

HostScanScriptMatchWhen
grove-fiis-y7ua8.pro77676607…https://grove-fiis-y7ua8.pro/t.js?site=ad06de319cd6ac7420f8c83c69cd3f13yara2026-10-11 14:07
braimzaii-rook.proc1efb491…https://braimzaii-rook.pro/t.js?site=16028874f6c3fe646f89fafd82fd3d07yara2026-10-11 11:51
braimzaii-rook.prob4c83827…https://braimzaii-rook.pro/t.js?site=2dfa2295744121fb46667c3b7972c509yara2026-10-11 11:18
braimzaii-rook.pro49c51f5e…https://braimzaii-rook.pro/t.js?site=62bf9cb49687dae215f96e5de06d336ayara2026-10-11 11:12
braimzaii-rook.pro6b77b9b2…https://braimzaii-rook.pro/t.js?site=b2acb4afdb38b4f36d0042ae99c1a9d9yara2026-10-11 11:08
birch-koix-7keeb.prod37b380f…https://birch-koix-7keeb.pro/t.js?site=ed53fbbf87354932e0f950461d8ab641yara2026-10-09 14:13
krioldflaeara-willow.pro41f69859…https://krioldflaeara-willow.pro/t.js?site=b01606694e2ab830c15f93fb3e2b5d23yara2026-10-08 14:21
poalmcreorvelvet.procf7d3ba5…https://poalmcreorvelvet.pro/t.js?site=3d8276a631a3290ca86ed844a2b414c7yara2026-10-08 12:31
poalmcreorvelvet.proe20ca4fe…https://poalmcreorvelvet.pro/t.js?site=56e03608d59b151c653bcfb00ef5417ayara2026-10-08 12:30
poalmcreorvelvet.pro47d44301…https://poalmcreorvelvet.pro/t.js?site=867e90889c4e81ba9e7c9c2ee44ff7ccyara2026-10-08 12:21
poalmcreorvelvet.pro47125f0f…https://poalmcreorvelvet.pro/t.js?site=1738c5255d7645512c76bc2438b08486yara2026-10-08 12:20
poalmcreorvelvet.prob0910aeb…https://poalmcreorvelvet.pro/t.js?site=126801aac0b281d53fae4caf6b6e3932yara2026-10-08 12:20
poalmcreorvelvet.pro3449b2b3…https://poalmcreorvelvet.pro/t.js?site=e231cd3ad9607c3300191e644965aae4yara2026-10-08 12:19
poalmcreorvelvet.prodc37ac5b…https://poalmcreorvelvet.pro/t.js?site=bc08c76574ae2b631f3d66ccc6a8e5e1yara2026-10-08 12:18
poalmcreorvelvet.prod724c1e4…https://poalmcreorvelvet.pro/t.js?site=0f9dc8f3eba90c37b4d550d9fda27722yara2026-10-08 12:04
ridge-goalmduix.pro21c16b54…https://ridge-goalmduix.pro/t.js?site=3176e354e755d8fc6ba9e6d58596bd13yara2026-10-08 12:03
krioldflaeara-willow.pro9da668de…https://krioldflaeara-willow.pro/t.js?site=1db22589e1062a671a8c358803e8ea89yara2026-10-08 12:02
poalmcreorvelvet.prodd377552…https://poalmcreorvelvet.pro/t.js?site=a13b84da2d4e06b258ba6fbb8d046467yara2026-10-08 12:01
poalmcreorvelvet.prob0e6cbf1…https://poalmcreorvelvet.pro/t.js?site=dd2e0de5498661872d7be28e4031cf96yara2026-10-08 12:00
poalmcreorvelvet.proa3ca44cb…https://poalmcreorvelvet.pro/t.js?site=32831ca5d6dee9beb0ede3a917663454yara2026-10-08 11:59
poalmcreorvelvet.pro5b0c67b7…https://poalmcreorvelvet.pro/t.js?site=1a43c8dc0aa6f4936c8287fc651567bcyara2026-10-08 11:58
poalmcreorvelvet.pro6c5040cb…https://poalmcreorvelvet.pro/t.js?site=3bc9d9b34bba1da64a63cf130a06f7fbyara2026-10-08 11:57
poalmcreorvelvet.pro4a8e0dd7…https://poalmcreorvelvet.pro/t.js?site=f8882cd9fcb61dcb0d21c8f031b5f07fyara2026-10-08 11:57
thistle-godbriaum.pro3ffd3dd2…https://thistle-godbriaum.pro/t.js?site=d85157d422ff810e14e967aeca8db6b8yara2026-10-08 11:53
poalmcreorvelvet.proe093581e…https://poalmcreorvelvet.pro/t.js?site=c3ae0203dedef51e8a359457e59e6d1dyara2026-10-08 11:51
poalmcreorvelvet.pro0976078d…https://poalmcreorvelvet.pro/t.js?site=20f8a1c0a1c17792ed19522f9ffec5ceyara2026-10-08 11:48
poalmcreorvelvet.prob17d803f…https://poalmcreorvelvet.pro/t.js?site=2bfe88672ad0ee6e44ef55c1662f7469yara2026-10-08 11:47
poalmcreorvelvet.pro293d54c4…https://poalmcreorvelvet.pro/t.js?site=eacc21e3a69f81e435c2cbad78f5e7a6yara2026-10-08 11:46
poalmcreorvelvet.pro13d33af8…https://poalmcreorvelvet.pro/t.js?site=37f87c5c14d7abd6191a4d8a2d5d49c2yara2026-10-08 11:45
poalmcreorvelvet.pro481f07a2…https://poalmcreorvelvet.pro/t.js?site=28db7623297ec142f445940404639548yara2026-10-08 11:43
poalmcreorvelvet.pro0314b9d8…https://poalmcreorvelvet.pro/t.js?site=30c37a6412a4dad63a5383e80e88c117yara2026-10-08 11:42
poalmcreorvelvet.pro87380694…https://poalmcreorvelvet.pro/t.js?site=267572a3a8a03c92ddea2fc39c185cb5yara2026-10-08 11:40
poalmcreorvelvet.pro7c1a6a5c…https://poalmcreorvelvet.pro/t.js?site=54bda98f18c63f82e854e3aa35475d19yara2026-10-08 11:40
poalmcreorvelvet.profd768f01…https://poalmcreorvelvet.pro/t.js?site=3aa77d8185b705c4d63000a329bc8d4cyara2026-10-08 11:38
poalmcreorvelvet.pro59073e0d…https://poalmcreorvelvet.pro/t.js?site=e1b6a2ff4605d330aa910ba370718044yara2026-10-08 11:36
poalmcreorvelvet.pro41fde6d1…https://poalmcreorvelvet.pro/t.js?site=8f0285f3f623e9b7bdd56af094de1d32yara2026-10-08 11:35
birch-koix-7keeb.pro6927894f…https://birch-koix-7keeb.pro/t.js?site=e889924177237b20b7a6e90a4e41f556yara2026-10-08 11:34
poalmcreorvelvet.pro79540ee3…https://poalmcreorvelvet.pro/t.js?site=6e42b1d51ead9dd48fc4072d1c84900eyara2026-10-08 11:32
poalmcreorvelvet.proccf3f4cf…https://poalmcreorvelvet.pro/t.js?site=f43ba7a70f38361d832a23c9a842ebceyara2026-10-08 11:32
poalmcreorvelvet.proc8b8b1f5…https://poalmcreorvelvet.pro/t.js?site=0597c0b793007b382c8d1cf99c5e6e31yara2026-10-08 11:31
poalmcreorvelvet.prof970dee8…https://poalmcreorvelvet.pro/t.js?site=e9f09df8e894068c656316081ba903b5yara2026-10-08 11:29
poalmcreorvelvet.pro699d473b…https://poalmcreorvelvet.pro/t.js?site=35d625f9789a64a58fbc77be80c52a52yara2026-10-08 11:27
poalmcreorvelvet.proe75a5dcb…https://poalmcreorvelvet.pro/t.js?site=105c20fb5ddb5f8de20c00e3ec66c112yara2026-10-08 11:25
poalmcreorvelvet.pro97353e1d…https://poalmcreorvelvet.pro/t.js?site=efc10221ce37a5146d33756d8a969dd0yara2026-10-08 11:24
ridge-goalmduix.pro7cb03d84…https://ridge-goalmduix.pro/t.js?site=d0d95e71443a7cc320b16fc36c8e6465yara2026-10-08 11:23
poalmcreorvelvet.proce770094…https://poalmcreorvelvet.pro/t.js?site=0a9cbb62a7ce15cf33c462208d738e8eyara2026-10-08 11:21
poalmcreorvelvet.pro881786b9…https://poalmcreorvelvet.pro/t.js?site=997aa0d065f042cc7329ec630b99c9eayara2026-10-08 11:19
poalmcreorvelvet.pro56bfdf55…https://poalmcreorvelvet.pro/t.js?site=e231cd3ad9607c3300191e644965aae4yara2026-10-08 11:19
thistle-godbriaum.pro99c029c9…https://thistle-godbriaum.pro/t.js?site=6520d05ec129072f80e182d5d00ce000yara2026-10-08 11:17
ridge-goalmduix.proc7907d7d…https://ridge-goalmduix.pro/t.js?site=3db321bf8067bee99f855469d8a2f95cyara2026-10-08 11:16
poalmcreorvelvet.pro54ea9654…https://poalmcreorvelvet.pro/t.js?site=425a206b8020ccccf8bb06396f37e2f2yara2026-10-08 10:44
poalmcreorvelvet.pro9ab7d2bf…https://poalmcreorvelvet.pro/t.js?site=e231cd3ad9607c3300191e644965aae4yara2026-10-08 10:42
thistle-godbriaum.pro41088b43…https://thistle-godbriaum.pro/t.js?site=bdf619591d7e5182d8554a0baa9bf3fcyara2026-10-08 07:26
misty-ripple-lark-kraiara.top13acd1c9…https://misty-ripple-lark-kraiara.top/t.js?site=b1d2cd6df23eb2d8b334d0f7dd4820deyara2026-10-04 04:26
misty-ripple-lark-kraiara.tope81095b7…https://misty-ripple-lark-kraiara.top/t.js?site=7eb73967cae22b6574bcb5481d5a5887yara2026-10-04 04:17
vale-quaeum-a4hc9.top60909419…https://vale-quaeum-a4hc9.top/t.js?site=80837bd0ff18c9dd763b261b8acdea68yara2026-10-03 10:26
vale-quaeum-a4hc9.topd84920c3…https://vale-quaeum-a4hc9.top/t.js?site=da08a9d27652987366eac2ecb0fd4dffyara2026-10-03 04:30
vale-quaeum-a4hc9.top017b752f…https://vale-quaeum-a4hc9.top/t.js?site=ad8e0068670502c8fce0c9dea2ecf4ffyara2026-10-03 04:26
vale-quaeum-a4hc9.top8c0914b2…https://vale-quaeum-a4hc9.top/t.js?site=7819cedd32f893d547428a256c3e8101yara2026-10-03 04:26
vale-quaeum-a4hc9.topd9e39960…https://vale-quaeum-a4hc9.top/t.js?site=0e067a00adcd7dbbbb58ec9b2517b2cbyara2026-10-03 04:26
coral-wren-friastquii.top46847c39…https://coral-wren-friastquii.top/t.js?site=2f5bfa03f6fbb4218dc2b436ff195926yara2026-10-01 13:05
velvet-otter-glagceis.life56d3c517…https://velvet-otter-glagceis.life/t.js?site=5f4af327bd1ad8ff858c6f714b27aca5yara2026-10-01 11:34
viorsoonlucid.life918cf92e…https://viorsoonlucid.life/t.js?site=d26f8c785b7b7c2cb72396692333cee3yara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifeff5ccee0…https://ashen-trace-zephyr-draeix.life/t.js?site=f933ac375a11e5ce08ad00c389b482dbyara2026-10-01 11:34
ashen-trace-zephyr-draeix.life8cb96fe2…https://ashen-trace-zephyr-draeix.life/t.js?site=5cd2b8caff6884ca436f77a21b9b8a0dyara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifeb8847741…https://ashen-trace-zephyr-draeix.life/t.js?site=410a0f6a2a8fd007d91c6b9d50d689a2yara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifeab7200b9…https://ashen-trace-zephyr-draeix.life/t.js?site=85dd5aa8a357f68226149bc42eb90e70yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life77c7f38b…https://ashen-trace-zephyr-draeix.life/t.js?site=2b9e905a6ddd5ee826a890872884025dyara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifeec4fc1b7…https://ashen-trace-zephyr-draeix.life/t.js?site=61f057b8554a9eaa5ac7be537d41816byara2026-10-01 11:34
ridge-ciosktai.site2c1a021f…https://ridge-ciosktai.site/t.js?site=8287bf8a0bdeeb8dec41ddba43a18bc3yara2026-10-01 11:34
viorsoonlucid.lifee765e9c4…https://viorsoonlucid.life/t.js?site=25493fdb70292dceac571f8f1dfd2ec3yara2026-10-01 11:34
gaezskoynbrisk.comc7487216…https://gaezskoynbrisk.com/t.js?site=6445962fb06c8430ee7fc4ad0a5009ceyara2026-10-01 11:34
brisk-forge-willow-caium.life093e9984…https://brisk-forge-willow-caium.life/t.js?site=dcdb370237ae9c5d8f39a0640f111e00yara2026-10-01 11:34
skaedbraearaquiet.life162a3322…https://skaedbraearaquiet.life/t.js?site=0af32dd92954b97ae8c86ced0d0a9801yara2026-10-01 11:34
flaempriarnnois.spacee25fcbb6…https://flaempriarnnois.space/t.js?site=fd146fad1e190c40ee7a2f451c7b7355yara2026-10-01 11:34
quiet-whirl-rook-stoon.livebcdba16f…https://quiet-whirl-rook-stoon.live/t.js?site=0a5ee62541462790795c9bf776522466yara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifea4a304ea…https://ashen-trace-zephyr-draeix.life/t.js?site=81672ff6ede79ad6ad754fef10804809yara2026-10-01 11:34
cabskaiyn-crane.life95c2e99a…https://cabskaiyn-crane.life/t.js?site=d88cf6c99dc9737e2ab38fb50c3d0abeyara2026-10-01 11:34
ashen-trace-zephyr-draeix.life6a7e15f8…https://ashen-trace-zephyr-draeix.life/t.js?site=36925ec65a79374fee9784a68f39357byara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifed700e7e5…https://ashen-trace-zephyr-draeix.life/t.js?site=6445962fb06c8430ee7fc4ad0a5009ceyara2026-10-01 11:34
ashen-trace-zephyr-draeix.life09d57c04…https://ashen-trace-zephyr-draeix.life/t.js?site=5b188e431f31eaece64ec455144a3f4cyara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifeb11194ac…https://ashen-trace-zephyr-draeix.life/t.js?site=6de80f99fb6fcbb88154f4838df422feyara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifef3742daf…https://ashen-trace-zephyr-draeix.life/t.js?site=d9241aca72db7d44888f03506845755ayara2026-10-01 11:34
brisk-forge-willow-caium.life399275d6…https://brisk-forge-willow-caium.life/t.js?site=5e74f89fd1a7388a7f957e384d605219yara2026-10-01 11:34
brisk-forge-willow-caium.life455ea5ef…https://brisk-forge-willow-caium.life/t.js?site=c2ddb96df5aba2f141b155702e91af4dyara2026-10-01 11:34
ridge-ciosktai.sitee8c7b1b7…https://ridge-ciosktai.site/t.js?site=f45c1c2ecec54cf85df63934a57617a2yara2026-10-01 11:34
mesa-braior-k3w3b.life6ffc1da8…https://mesa-braior-k3w3b.life/t.js?site=cf726db93087c8d23ab9fcf3072a3d47yara2026-10-01 11:34
krestmoais-reed.life379a4850…https://krestmoais-reed.life/t.js?site=21a5dc833537430bb9a73f4f1ee6bb38yara2026-10-01 11:34
velvet-otter-glagceis.lifea4d1d61d…https://velvet-otter-glagceis.life/t.js?site=39c62dcebf605b107c56d6cd472ad9f5yara2026-10-01 11:34
velvet-otter-glagceis.lifec57cb5b9…https://velvet-otter-glagceis.life/t.js?site=5cefddeadb74fee210f10bf64a9c9ae5yara2026-10-01 11:34
krestmoais-reed.life7a4aadbf…https://krestmoais-reed.life/t.js?site=8287bf8a0bdeeb8dec41ddba43a18bc3yara2026-10-01 11:34
skaedbraearaquiet.life01a9e484…https://skaedbraearaquiet.life/t.js?site=db1be5df265c76f81503d0ef28a78eedyara2026-10-01 11:34
flaempriarnnois.spacec020e9a8…https://flaempriarnnois.space/t.js?site=1e67da8c7fc1266a04b67e3a13484102yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life5e5aef27…https://ashen-trace-zephyr-draeix.life/t.js?site=40043b2d59dc7814bc3240c12e4f7c85yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life268b8898…https://ashen-trace-zephyr-draeix.life/t.js?site=aab932fb7983cc2babbc1b29287fcd64yara2026-10-01 11:34
gonfuirkgroao.life9cc1d57e…https://gonfuirkgroao.life/t.js?site=2d4f83c1a183908c245bba1377f50a4byara2026-10-01 11:34
amber-ridge-bruixsioi.live2d036528…https://amber-ridge-bruixsioi.live/t.js?site=bff7f497678f7895df2250e5646b00d4yara2026-10-01 11:34
brisk-forge-willow-caium.lifedf2e120b…https://brisk-forge-willow-caium.life/t.js?site=5c66b4a1d6a9bfa4fae44ad36d766422yara2026-10-01 11:34
velvet-otter-glagceis.life1ee6a8b8…https://velvet-otter-glagceis.life/t.js?site=f7881f46f1fc447e5a2f0642eeee72a5yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life2070e372…https://ashen-trace-zephyr-draeix.life/t.js?site=5feb83580e79cbc9e7e54e316d8b36deyara2026-10-01 11:34
hollow-forge-rook-guiyn.lifeed22b657…https://hollow-forge-rook-guiyn.life/t.js?site=ce5d742b724078d2cf9be5a8339140c9yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life263206d3…https://ashen-trace-zephyr-draeix.life/t.js?site=32b3ee86a5957419946a28d3cbb42241yara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifef3b35f1c…https://ashen-trace-zephyr-draeix.life/t.js?site=ba22fbef1c87d14c7246f1fda5a6615ayara2026-10-01 11:34
coral-zephyr-koarseara.xyzfc122e8a…https://coral-zephyr-koarseara.xyz/t.js?site=9c2b98a29e92b08a34e771ad4fde456byara2026-10-01 11:34
kiln-skioi-c29up.comef5155a4…https://kiln-skioi-c29up.com/t.js?site=2da951ffc094efa63a922a272bfd5627yara2026-10-01 11:34
flaempriarnnois.space8bb233fb…https://flaempriarnnois.space/t.js?site=bec959008881fceefa92423685206295yara2026-10-01 11:34
mesa-seen-dcjcj.live88eea211…https://mesa-seen-dcjcj.live/t.js?site=b629c76d860aa95f2ccd8a31e7a68830yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life0ca60b62…https://ashen-trace-zephyr-draeix.life/t.js?site=e7d8b6b015cfac76a90c77257c6f7973yara2026-10-01 11:34
brisk-forge-willow-caium.lifea7961a3a…https://brisk-forge-willow-caium.life/t.js?site=15430fc5144fc20664f042cd68471de1yara2026-10-01 11:34
mesa-braior-k3w3b.life9d105866…https://mesa-braior-k3w3b.life/t.js?site=5abe42f728e908f43b41b16e2beab017yara2026-10-01 11:34
velvet-otter-glagceis.lifeb261c3fc…https://velvet-otter-glagceis.life/t.js?site=51f4e30fdce9a570ee68fd9aeeba120fyara2026-10-01 11:34
quiet-ridge-slaikdoaen.com5cef15d1…https://quiet-ridge-slaikdoaen.com/t.js?site=1e079c5fd60074ad2b5229d3ac7d8596yara2026-10-01 11:34
viorsoonlucid.life5d371917…https://viorsoonlucid.life/t.js?site=511c8acaf06b8c66df033f973252b64dyara2026-10-01 11:34
brisk-forge-willow-caium.lifec7314afc…https://brisk-forge-willow-caium.life/t.js?site=5ce30629c1d9e8b5bf20595e95256e89yara2026-10-01 11:34
coral-zephyr-koarseara.xyz429a2597…https://coral-zephyr-koarseara.xyz/t.js?site=170ae6a4716993d87fc029453e158173yara2026-10-01 11:34
rerrioara.live55fb1058…https://rerrioara.live/t.js?site=b25b4916375d87609932d87bf71990b9yara2026-10-01 11:34
ridge-ciosktai.site854729a8…https://ridge-ciosktai.site/t.js?site=3aa25c90f70f05540c17f9ada62e88ceyara2026-10-01 11:34
velvet-otter-glagceis.life1133dc37…https://velvet-otter-glagceis.life/t.js?site=fd146fad1e190c40ee7a2f451c7b7355yara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifecffe7b24…https://ashen-trace-zephyr-draeix.life/t.js?site=0ef948831de750cc3271b8200a8dde7dyara2026-10-01 11:34
coral-weave-wren-veis.com8dd25257…https://coral-weave-wren-veis.com/t.js?site=31ba2a351e73b4a3325726af88a9e553yara2026-10-01 11:34
gaezskoynbrisk.comc7a2e1ba…https://gaezskoynbrisk.com/t.js?site=40be8ab2fd92aa094d0312f1d3e93444yara2026-10-01 11:34
mesa-braior-k3w3b.life68814cb7…https://mesa-braior-k3w3b.life/t.js?site=31e4f6f7e2e79b3f1099a72942db3460yara2026-10-01 11:34
quiet-ridge-slaikdoaen.com1d979d45…https://quiet-ridge-slaikdoaen.com/t.js?site=86c26d047692e287b998e88adb04347ayara2026-10-01 11:34
gonfuirkgroao.life9db6b97b…https://gonfuirkgroao.life/t.js?site=36b37bac8b7a8a6cbb3d80b1003ae8cayara2026-10-01 11:34