Birdeye ClickFix kit

Birdeye is a ClickFix lure that builds its command from char-code arrays and puts it on the clipboard from a fake Cloudflare check. We have matched it on 2 sites since 11 October.

Research by Kirk

Birdeye in numbers

Since 11 October, the first Birdeye match in our records, counted on 13 October 2026. How we count.

Sites with Birdeye code	2
Sites with a match in the last 30 days	2
New sites in October so far	2

Recorded Future named the code Birdeye

Recorded Future's Insikt Group calls this ClickFix lure "Cluster 3: Birdeye" and published its source. The name has nothing to do with Birdeye, the review-widget company.

Seven arrays build the command

The source defines seven arrays under obfuscatedCommandParts. Its builder maps each array through String.fromCharCode, joins the decoded fragments and keeps the completed command in one variable.

The pages we capture carry that source unchanged: the same arrays, builder, Russian comments and fake Cloudflare page. The decoded command is PowerShell that downloads a text file from alababababa[.]cloud through Net.WebClient and runs it.

The checkbox controls the clipboard

Clicking the fake check writes the assembled command into a hidden text area and calls document.execCommand('copy'). A global copy handler replaces anything else the visitor copies with that command.

The page then shows the Win+R steps. When the visitor finishes, it posts to /verify-complete and reloads.

What we see

Month	New sites
September	0
October so far	2

Finding the Birdeye lure

Search the raw response and rendered page for:

obfuscatedCommandParts containing the char-code arrays
String.fromCharCode(...partArray) followed by join('')
a fake Cloudflare check with Win+R instructions
a hidden text area passed to document.execCommand('copy')
a global copy handler that sets text/plain to the assembled command
a completion request to /verify-complete

Remove the lure and the server-side change that placed it. Review hosting and deployment access and rotate their credentials.