ProxySig ClickFix kit

ProxySig retrieves code through a same-origin contract relay and executes the Base64 response. We have matched it on 41 sites since 2 September.

Research by Kirk

ProxySig in numbers

Since 2 September, the first ProxySig match in our records, counted on 12 October 2026. How we count.

Sites with ProxySig code	41
Sites with a match in the last 30 days	38
New sites in September	12
Still serving it when recaptured at least 25 days later	1 of 1 site (100%)
Sites running WordPress (captured since 25 September)	47%

A contract call behind the site's own URL

ProxySig is our name for a loader that sends a JSON request to /__rpc_proxy__ on the compromised site's origin. The body contains a contract address and method selector. The site handles the blockchain request, so the visitor's browser contacts a familiar origin instead of a public RPC service.

Contract	Chain	Selector
`0x7Fd85c090f2b35071C57a3b9FeAF462aaEb0E437`	BNB Smart Chain testnet	`0x6d4ce63c`
`0xFB448D465841C63F3bC433be61Eb692b813D469d`	BNB Smart Chain testnet	`0x6d4ce63c`

These contract values also appear in DoubleDonut. ProxySig's same-origin relay and inline execution form a separate loader.

The returned signature becomes code

The relay replies with a JSON property named signature. ProxySig decodes that value with atob, assigns the result to a new script element and adds it to the document. The loader has appeared inside ordinary pages and hosting error documents, showing that the insertion can survive a failed origin response.

The decoded script applies visitor gates and requests another script. September captures use a randomised /jsrepo path with a timestamp and random value. October builds add a Windows check, skip pages with the WordPress admin bar and preconnect to the script host. A later October copy changes the request to the fixed path /js/my. Both forms retry the request and add the returned script to the page.

For site review, the earlier same-origin request and the decoded visitor gates provide small, stable starting points.

What we see

Month	New sites
September	12
October so far	29

The persistence check found ProxySig again on 1 of 1 site recaptured at least 25 days after their first match (100%). 47% of ProxySig sites captured since 25 September run WordPress.

30 ProxySig sites also carry DoubleDonut. Review both injection paths when the families overlap.

Checking a site

Search raw responses and site routes for:

POST requests to /__rpc_proxy__
a JSON body with contract and method fields
a signature response passed to atob
decoded text assigned to a new script element
the Windows and wpadminbar gates in the decoded stage
randomised /jsrepo or fixed /js/my script requests

Include error responses in the review. Verified matches occur in edge-generated and hosting error documents as well as ordinary pages.