PixelMenu affiliate fraud kit
PixelMenu is a Joomla menu injection that loads remote scripts through an image's onload handler. The scripts hijack clicks and Back navigation or display a Bitcoin lottery offer. We have matched it on 121 sites since 26 September.
PixelMenu in numbers
Since 26 September, the first PixelMenu match in our records, counted on 14 October 2026. How we count.
| Sites with PixelMenu code | 121 |
|---|---|
| Sites with a match in the last 30 days | 121 |
| New sites in September | 4 |
| Still serving it when recaptured at least 25 days later | 0 of 0 sites (0%) |
A menu image imports the remote script
PixelMenu sits inside a Joomla menu item. Its image source is an embedded one-pixel GIF, and the onload attribute calls eval(atob()) on a Base64 string. The decoded text creates a script element and appends it to the page body.
The imports load hxxps://siltamaja[.]lv/js/jquery.hotlink.js or hxxps://siltamaja[.]lv/js/jquery.popup.js. A broken <wbr id=" tail follows the image handler in the injected menu markup.
A cookie gates the click and Back-button hijack
jquery.hotlink.js hex-decodes a destination under hxxps://herculex[.]top/help/. It checks for an external referrer and a tmr_pid_767 cookie. On the first visit it sets that cookie with a one-day expiry; when the referrer passes the check, it installs a document-wide click handler and a history trap.
The click handler opens the decoded destination, then clears itself. collectCover() replaces the current history entry with a #backcover marker and pushes another entry. Pressing Back reaches that marker and triggers location.replace to the same destination.
The lottery popup waits for an external referrer
jquery.popup.js runs when the referrer is present and does not contain the site's hostname. It compares the current UTC date with lotteryLastShown in local storage, records the date and shows an overlay offering a chance to win "20 Bitcoin" and a free lottery ticket.
The ticket button opens hxxps://siltamaja[.]lv/uploads/media/ticket/ in a new tab and hides the overlay. The daily marker suppresses the popup on repeat visits from the same browser profile.
What we see
| Month | New sites |
|---|---|
| September | 4 |
| October so far | 117 |
Among successful captures since 25 September, 36 of 37 PixelMenu sites made requests for Joomla core paths. Of the 0 sites recaptured at least 25 days after their first match, 0 still served PixelMenu (0%).
Checking the menu and browser state
Keep the original HTML, rendered menu and imported scripts. Look for:
- an embedded one-pixel GIF inside a Joomla menu item
onloadcallingeval(atob())and a malformedwbrtail- remote imports named
jquery.hotlink.jsorjquery.popup.js - the
tmr_pid_767cookie andcollectCover()history handler - a
#backcoverhistory entry that redirects when Back is pressed lotteryLastShownand a lottery overlay on externally referred visits
Remove the injected menu content and clear cached copies. Compare Joomla extensions and templates with trusted releases, review administrator and hosting access and rotate affected credentials. Retest from a clean browser profile through an external referral, then click the page and press Back.