ScanMalware.com
Known malicious kitcriticalphishing

ClearFake — Polygon contract loader on compromised sites (YARA)

family: clearfake-polygon-loader-2026-10

Script injected into compromised websites. For Windows visitors that are not crawlers it reads a list of servers from a Polygon smart contract (EtherHiding: eth_call to selector 0x3bc5de30 through public RPC nodes), decodes it, and loads <server>/js/all.min.js?m=1, the next stage of a ClickFix chain. The servers rotate through the contract, so the match is on the loader code, not on any host.

Anchors

YARA ruleClearFake_Polygon_Contract_Loader

Provenance

Added: 2026-10-01 17:22
Requires eth_call, a Polygon RPC host, and the selector or the stage path together with the loader functions, so an ordinary web3 page reading a Polygon contract does not match. Contracts seen: 0xa1cb583820EfE60c840498aaDa3f741Ab6869cBE, 0xF20221C0Cf767EEe759bBE1Fb8dd76EaeF0e5779, 0x91639826046FD209ef96c76CF9089E6Dde2d408A, 0x4F99A81e59311768e786DE5d1c58AC6d354c649d, 0x88411E5440e1482f0ABCB5212dAeab28Cf3332C1.
References:

Sightings (37)

HostScanScriptMatchWhen
newdigimatic.com#htmld49e3ae6…https://newdigimatic.com#htmlyara2026-10-01 19:17
elektrikclothing.com#html5f4b4cd3…https://elektrikclothing.com#htmlyara2026-10-01 19:17
brixlysafaris.com#htmlbda1ff50…https://brixlysafaris.com#htmlyara2026-10-01 19:17
dein-sandmann.de46847c39…https://dein-sandmann.de/#htmlyara2026-10-01 19:17
naturfotografie-roman-vitt.de#htmlb261c3fc…https://naturfotografie-roman-vitt.de#htmlyara2026-10-01 19:17
www.skoar.gg0e4140c8…https://www.skoar.gg/breaking-news/ocarina-of-time-remake-confirmed-for-development/#htmlyara2026-10-01 19:17
corrieredellaverita.it#html8bb233fb…https://corrieredellaverita.it#htmlyara2026-10-01 19:17
solmechanical.com#htmld8280da1…https://solmechanical.com#htmlyara2026-10-01 19:17
suicidesurvivorguide.com#html7a022eb2…https://suicidesurvivorguide.com#htmlyara2026-10-01 19:17
pacharagems.com#html0ca60b62…https://pacharagems.com#htmlyara2026-10-01 19:17
lack-behnke.de#htmlec02ce3c…https://lack-behnke.de#htmlyara2026-10-01 19:17
lopalooza.org0aebc623…https://lopalooza.org/#htmlyara2026-10-01 19:17
georgebakes.com#htmle5d900e1…https://georgebakes.com#htmlyara2026-10-01 19:17
editions-canaima.com#htmlc57cb5b9…https://editions-canaima.com#htmlyara2026-10-01 19:17
Www.theoryofliving.com#htmle878de64…https://Www.theoryofliving.com#htmlyara2026-10-01 19:17
www.becrepress.com#html95c2e99a…https://www.becrepress.com#htmlyara2026-10-01 19:17
heartandshape.com#html1e118494…https://heartandshape.com#htmlyara2026-10-01 19:17
driftwoodresortmn.com#html77c7f38b…https://driftwoodresortmn.com#htmlyara2026-10-01 17:22
wordpresshjalp.se#html1e258468…https://wordpresshjalp.se#htmlyara2026-10-01 17:22
wordpresshjalp.sea85c1521…https://wordpresshjalp.se/#htmlyara2026-10-01 17:22
parcelcourierline.coma1294de5…https://parcelcourierline.com/#htmlyara2026-10-01 17:22
solarwinds-in.com#html80bf6a8d…https://solarwinds-in.com#htmlyara2026-10-01 17:22
aitesas.com#html245c6082…https://aitesas.com#htmlyara2026-10-01 17:22
ambiancewax.com#htmlec4fc1b7…https://ambiancewax.com#htmlyara2026-10-01 17:22
beatrizmontes.com#htmlb8847741…https://beatrizmontes.com#htmlyara2026-10-01 17:22
maxfel.se8315b668…https://maxfel.se/#htmlyara2026-10-01 17:22
copier.pkfa30a35e…https://copier.pk/product-tag/rawalpindi/?srsltid=afmboooxrxqhx_9ww69ykky56icefwef6mx2d4cyfge187mr1rfxw8ui#htmlyara2026-10-01 17:22
littleolange.com#html399275d6…https://littleolange.com#htmlyara2026-10-01 17:22
wordpresshjalp.see69bda78…https://wordpresshjalp.se/#htmlyara2026-10-01 17:22
cookwithlina.com#htmlab7200b9…https://cookwithlina.com#htmlyara2026-10-01 17:22
maxfel.se340b5064…https://maxfel.se/#htmlyara2026-10-01 17:22
medmark.sa#htmlb3dcaa07…https://medmark.sa#htmlyara2026-10-01 17:22
21-realty.com#htmlcffe7b24…https://21-realty.com#htmlyara2026-10-01 17:22
saggang.com#html1133dc37…https://saggang.com#htmlyara2026-10-01 17:22
logm-justia.com#html5bec6271…https://logm-justia.com#htmlyara2026-10-01 17:22
saggang.com#htmle25fcbb6…https://saggang.com#htmlyara2026-10-01 17:22
maxfel.se#htmldc180c30…https://maxfel.se#htmlyara2026-10-01 17:22