ScanMalware.com
Known malicious kithighphishing

ClearFake — rival-kit cleanup script on compromised sites (YARA)

family: clearfake-polygon-loader-2026-10

Script injected beside the ClearFake Polygon loader. It removes other ClickFix kits' scripts, overlays and stored state from the page, keeps its own overlay on screen, and blocks navigation for up to 45 seconds while that overlay is shown.

Anchors

YARA ruleClearFake_Rival_Kit_Cleanup

Provenance

Added: 2026-10-01 17:22
Requires the script's own marker attribute and two of its function names, or four of the function names.
References:

Sightings (7)

HostScanScriptMatchWhen
wordpresshjalp.se#html1e258468…https://wordpresshjalp.se#htmlyara2026-10-01 17:22
wordpresshjalp.sea85c1521…https://wordpresshjalp.se/#htmlyara2026-10-01 17:22
parcelcourierline.coma1294de5…https://parcelcourierline.com/#htmlyara2026-10-01 17:22
maxfel.se8315b668…https://maxfel.se/#htmlyara2026-10-01 17:22
wordpresshjalp.see69bda78…https://wordpresshjalp.se/#htmlyara2026-10-01 17:22
maxfel.se340b5064…https://maxfel.se/#htmlyara2026-10-01 17:22
maxfel.se#htmldc180c30…https://maxfel.se#htmlyara2026-10-01 17:22