ScanMalware.com
Known malicious kitcriticalstealer

Macfinger ClickFix — fingerprinting stage ext-b.4f9db6afd06a.js (content match)

family: macfinger-clickfix-2026-09

Byte-identical copies of the Macfinger ClickFix fingerprinting script ext-b.4f9db6afd06a.js, the build current in late September 2026, which decides whether to show the fake verification page.

Anchors

content sha2564f9db6afd06aab4045d89a679191e154cc8cd283392d1f3bd16ac31347e1c3ac

Provenance

Added: 2026-09-23 13:19
Exact content match only. Earlier builds are covered by the tracker row in this family.
References:

Sightings (13)

HostScanScriptMatchWhen
cabskaiyn-crane.life95c2e99a…https://cabskaiyn-crane.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
mesa-braior-k3w3b.life6ffc1da8…https://mesa-braior-k3w3b.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
gonfuirkgroao.life9db6b97b…https://gonfuirkgroao.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
gonfuirkgroao.life9cc1d57e…https://gonfuirkgroao.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
brisk-forge-willow-caium.lifedf2e120b…https://brisk-forge-willow-caium.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
brisk-forge-willow-caium.life093e9984…https://brisk-forge-willow-caium.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
brisk-forge-willow-caium.lifec7314afc…https://brisk-forge-willow-caium.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
krestmoais-reed.life379a4850…https://krestmoais-reed.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
brisk-forge-willow-caium.life399275d6…https://brisk-forge-willow-caium.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
krestmoais-reed.life7a4aadbf…https://krestmoais-reed.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
velvet-otter-glagceis.life56d3c517…https://velvet-otter-glagceis.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
velvet-otter-glagceis.lifeb261c3fc…https://velvet-otter-glagceis.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19
velvet-otter-glagceis.lifea4d1d61d…https://velvet-otter-glagceis.life/ext-b.4f9db6afd06a.jsbyte2026-09-23 13:19