ScanMalware.com
Known malicious kitcriticalstealer

Macfinger ClickFix — per-site first stage t.js?site= (YARA)

family: macfinger-clickfix-2026-09

The first-stage script that compromised websites load from a rotating attacker domain as /t.js?site=<32 hex>. Its content differs for every victim site, so it is matched by structure: the analytics and A/B-test globals it sets, together with its references to the content-addressed loader t.<hash>.js and the ext-b fingerprinting stage.

Anchors

YARA ruleClickFix_BotProtection_Loader

Provenance

Added: 2026-10-01 11:33
Detection rule by Ransom-ISAC. Matches the first stage only, not the shared loader or the fingerprinting script, and not look-alike t.js?site= scripts that never load t.<hash>.js and ext-b.
References:

Sightings (64)

HostScanScriptMatchWhen
coral-wren-friastquii.top46847c39…https://coral-wren-friastquii.top/t.js?site=2f5bfa03f6fbb4218dc2b436ff195926yara2026-10-01 13:05
velvet-otter-glagceis.life56d3c517…https://velvet-otter-glagceis.life/t.js?site=5f4af327bd1ad8ff858c6f714b27aca5yara2026-10-01 11:34
viorsoonlucid.life918cf92e…https://viorsoonlucid.life/t.js?site=d26f8c785b7b7c2cb72396692333cee3yara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifeff5ccee0…https://ashen-trace-zephyr-draeix.life/t.js?site=f933ac375a11e5ce08ad00c389b482dbyara2026-10-01 11:34
ashen-trace-zephyr-draeix.life8cb96fe2…https://ashen-trace-zephyr-draeix.life/t.js?site=5cd2b8caff6884ca436f77a21b9b8a0dyara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifeb8847741…https://ashen-trace-zephyr-draeix.life/t.js?site=410a0f6a2a8fd007d91c6b9d50d689a2yara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifeab7200b9…https://ashen-trace-zephyr-draeix.life/t.js?site=85dd5aa8a357f68226149bc42eb90e70yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life77c7f38b…https://ashen-trace-zephyr-draeix.life/t.js?site=2b9e905a6ddd5ee826a890872884025dyara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifeec4fc1b7…https://ashen-trace-zephyr-draeix.life/t.js?site=61f057b8554a9eaa5ac7be537d41816byara2026-10-01 11:34
ridge-ciosktai.site2c1a021f…https://ridge-ciosktai.site/t.js?site=8287bf8a0bdeeb8dec41ddba43a18bc3yara2026-10-01 11:34
viorsoonlucid.lifee765e9c4…https://viorsoonlucid.life/t.js?site=25493fdb70292dceac571f8f1dfd2ec3yara2026-10-01 11:34
gaezskoynbrisk.comc7487216…https://gaezskoynbrisk.com/t.js?site=6445962fb06c8430ee7fc4ad0a5009ceyara2026-10-01 11:34
brisk-forge-willow-caium.life093e9984…https://brisk-forge-willow-caium.life/t.js?site=dcdb370237ae9c5d8f39a0640f111e00yara2026-10-01 11:34
skaedbraearaquiet.life162a3322…https://skaedbraearaquiet.life/t.js?site=0af32dd92954b97ae8c86ced0d0a9801yara2026-10-01 11:34
flaempriarnnois.spacee25fcbb6…https://flaempriarnnois.space/t.js?site=fd146fad1e190c40ee7a2f451c7b7355yara2026-10-01 11:34
quiet-whirl-rook-stoon.livebcdba16f…https://quiet-whirl-rook-stoon.live/t.js?site=0a5ee62541462790795c9bf776522466yara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifea4a304ea…https://ashen-trace-zephyr-draeix.life/t.js?site=81672ff6ede79ad6ad754fef10804809yara2026-10-01 11:34
cabskaiyn-crane.life95c2e99a…https://cabskaiyn-crane.life/t.js?site=d88cf6c99dc9737e2ab38fb50c3d0abeyara2026-10-01 11:34
ashen-trace-zephyr-draeix.life6a7e15f8…https://ashen-trace-zephyr-draeix.life/t.js?site=36925ec65a79374fee9784a68f39357byara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifed700e7e5…https://ashen-trace-zephyr-draeix.life/t.js?site=6445962fb06c8430ee7fc4ad0a5009ceyara2026-10-01 11:34
ashen-trace-zephyr-draeix.life09d57c04…https://ashen-trace-zephyr-draeix.life/t.js?site=5b188e431f31eaece64ec455144a3f4cyara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifeb11194ac…https://ashen-trace-zephyr-draeix.life/t.js?site=6de80f99fb6fcbb88154f4838df422feyara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifef3742daf…https://ashen-trace-zephyr-draeix.life/t.js?site=d9241aca72db7d44888f03506845755ayara2026-10-01 11:34
brisk-forge-willow-caium.life399275d6…https://brisk-forge-willow-caium.life/t.js?site=5e74f89fd1a7388a7f957e384d605219yara2026-10-01 11:34
brisk-forge-willow-caium.life455ea5ef…https://brisk-forge-willow-caium.life/t.js?site=c2ddb96df5aba2f141b155702e91af4dyara2026-10-01 11:34
ridge-ciosktai.sitee8c7b1b7…https://ridge-ciosktai.site/t.js?site=f45c1c2ecec54cf85df63934a57617a2yara2026-10-01 11:34
mesa-braior-k3w3b.life6ffc1da8…https://mesa-braior-k3w3b.life/t.js?site=cf726db93087c8d23ab9fcf3072a3d47yara2026-10-01 11:34
krestmoais-reed.life379a4850…https://krestmoais-reed.life/t.js?site=21a5dc833537430bb9a73f4f1ee6bb38yara2026-10-01 11:34
velvet-otter-glagceis.lifea4d1d61d…https://velvet-otter-glagceis.life/t.js?site=39c62dcebf605b107c56d6cd472ad9f5yara2026-10-01 11:34
velvet-otter-glagceis.lifec57cb5b9…https://velvet-otter-glagceis.life/t.js?site=5cefddeadb74fee210f10bf64a9c9ae5yara2026-10-01 11:34
krestmoais-reed.life7a4aadbf…https://krestmoais-reed.life/t.js?site=8287bf8a0bdeeb8dec41ddba43a18bc3yara2026-10-01 11:34
skaedbraearaquiet.life01a9e484…https://skaedbraearaquiet.life/t.js?site=db1be5df265c76f81503d0ef28a78eedyara2026-10-01 11:34
flaempriarnnois.spacec020e9a8…https://flaempriarnnois.space/t.js?site=1e67da8c7fc1266a04b67e3a13484102yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life5e5aef27…https://ashen-trace-zephyr-draeix.life/t.js?site=40043b2d59dc7814bc3240c12e4f7c85yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life268b8898…https://ashen-trace-zephyr-draeix.life/t.js?site=aab932fb7983cc2babbc1b29287fcd64yara2026-10-01 11:34
gonfuirkgroao.life9cc1d57e…https://gonfuirkgroao.life/t.js?site=2d4f83c1a183908c245bba1377f50a4byara2026-10-01 11:34
amber-ridge-bruixsioi.live2d036528…https://amber-ridge-bruixsioi.live/t.js?site=bff7f497678f7895df2250e5646b00d4yara2026-10-01 11:34
brisk-forge-willow-caium.lifedf2e120b…https://brisk-forge-willow-caium.life/t.js?site=5c66b4a1d6a9bfa4fae44ad36d766422yara2026-10-01 11:34
velvet-otter-glagceis.life1ee6a8b8…https://velvet-otter-glagceis.life/t.js?site=f7881f46f1fc447e5a2f0642eeee72a5yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life2070e372…https://ashen-trace-zephyr-draeix.life/t.js?site=5feb83580e79cbc9e7e54e316d8b36deyara2026-10-01 11:34
hollow-forge-rook-guiyn.lifeed22b657…https://hollow-forge-rook-guiyn.life/t.js?site=ce5d742b724078d2cf9be5a8339140c9yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life263206d3…https://ashen-trace-zephyr-draeix.life/t.js?site=32b3ee86a5957419946a28d3cbb42241yara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifef3b35f1c…https://ashen-trace-zephyr-draeix.life/t.js?site=ba22fbef1c87d14c7246f1fda5a6615ayara2026-10-01 11:34
coral-zephyr-koarseara.xyzfc122e8a…https://coral-zephyr-koarseara.xyz/t.js?site=9c2b98a29e92b08a34e771ad4fde456byara2026-10-01 11:34
kiln-skioi-c29up.comef5155a4…https://kiln-skioi-c29up.com/t.js?site=2da951ffc094efa63a922a272bfd5627yara2026-10-01 11:34
flaempriarnnois.space8bb233fb…https://flaempriarnnois.space/t.js?site=bec959008881fceefa92423685206295yara2026-10-01 11:34
mesa-seen-dcjcj.live88eea211…https://mesa-seen-dcjcj.live/t.js?site=b629c76d860aa95f2ccd8a31e7a68830yara2026-10-01 11:34
ashen-trace-zephyr-draeix.life0ca60b62…https://ashen-trace-zephyr-draeix.life/t.js?site=e7d8b6b015cfac76a90c77257c6f7973yara2026-10-01 11:34
brisk-forge-willow-caium.lifea7961a3a…https://brisk-forge-willow-caium.life/t.js?site=15430fc5144fc20664f042cd68471de1yara2026-10-01 11:34
mesa-braior-k3w3b.life9d105866…https://mesa-braior-k3w3b.life/t.js?site=5abe42f728e908f43b41b16e2beab017yara2026-10-01 11:34
velvet-otter-glagceis.lifeb261c3fc…https://velvet-otter-glagceis.life/t.js?site=51f4e30fdce9a570ee68fd9aeeba120fyara2026-10-01 11:34
quiet-ridge-slaikdoaen.com5cef15d1…https://quiet-ridge-slaikdoaen.com/t.js?site=1e079c5fd60074ad2b5229d3ac7d8596yara2026-10-01 11:34
viorsoonlucid.life5d371917…https://viorsoonlucid.life/t.js?site=511c8acaf06b8c66df033f973252b64dyara2026-10-01 11:34
brisk-forge-willow-caium.lifec7314afc…https://brisk-forge-willow-caium.life/t.js?site=5ce30629c1d9e8b5bf20595e95256e89yara2026-10-01 11:34
coral-zephyr-koarseara.xyz429a2597…https://coral-zephyr-koarseara.xyz/t.js?site=170ae6a4716993d87fc029453e158173yara2026-10-01 11:34
rerrioara.live55fb1058…https://rerrioara.live/t.js?site=b25b4916375d87609932d87bf71990b9yara2026-10-01 11:34
ridge-ciosktai.site854729a8…https://ridge-ciosktai.site/t.js?site=3aa25c90f70f05540c17f9ada62e88ceyara2026-10-01 11:34
velvet-otter-glagceis.life1133dc37…https://velvet-otter-glagceis.life/t.js?site=fd146fad1e190c40ee7a2f451c7b7355yara2026-10-01 11:34
ashen-trace-zephyr-draeix.lifecffe7b24…https://ashen-trace-zephyr-draeix.life/t.js?site=0ef948831de750cc3271b8200a8dde7dyara2026-10-01 11:34
coral-weave-wren-veis.com8dd25257…https://coral-weave-wren-veis.com/t.js?site=31ba2a351e73b4a3325726af88a9e553yara2026-10-01 11:34
gaezskoynbrisk.comc7a2e1ba…https://gaezskoynbrisk.com/t.js?site=40be8ab2fd92aa094d0312f1d3e93444yara2026-10-01 11:34
mesa-braior-k3w3b.life68814cb7…https://mesa-braior-k3w3b.life/t.js?site=31e4f6f7e2e79b3f1099a72942db3460yara2026-10-01 11:34
quiet-ridge-slaikdoaen.com1d979d45…https://quiet-ridge-slaikdoaen.com/t.js?site=86c26d047692e287b998e88adb04347ayara2026-10-01 11:34
gonfuirkgroao.life9db6b97b…https://gonfuirkgroao.life/t.js?site=36b37bac8b7a8a6cbb3d80b1003ae8cayara2026-10-01 11:34