TableFrame ClickFix kit
TableFrame is a ClickFix loader that encodes a browser fingerprint before fetching and inserting its landing page. We have matched it on 122 sites since 3 October.
TableFrame in numbers
Since 3 October, the first TableFrame match in our records, counted on 12 October 2026. How we count.
| Sites with TableFrame code | 122 |
|---|---|
| Sites with a match in the last 30 days | 122 |
| New sites in September | 0 |
| Sites running WordPress (captured since 25 September) | 99% |
A short injection adds cT.js
TableFrame is our name for a two-part ClickFix loader. The first part creates a script element whose source ends in /cT.js and appends it to the document head. Retained copies place that snippet directly in HTML, append it to an otherwise familiar first-party JavaScript file or run it from a data: script.
The external host rotates while the /cT.js path and the second stage stay recognizable. A recent production response showed the complete loader appended to a theme script, making the added code easy to miss in a large file.
The table turns a fingerprint into a request path
The loader records the visitor's colour scheme, timezone, screen width and height, pixel ratio, calculated resolution, local-storage availability and navigator.webdriver value. It joins those fields with |.
Its encode(table, data) function converts each character to a number, multiplies that number by two and takes the corresponding two characters from a long substitution table. randomCase then changes the case of every letter. The result becomes the request path sent to the landing controller.
The response is either a 32-character sentinel or HTML. For HTML, TableFrame waits 100 milliseconds and inserts the response at the end of the page body. The loader also accepts cookie and reload messages from the inserted page; the cookie branch sets a one-year marker and reloads the page.
The returned page stages a false verification
A retained landing response showed a Cloudflare-style integrity check followed by a checkbox and a "Verification required" window. On Windows, the window told the visitor to press Win+R, paste with Ctrl+V and press Enter. The page copied a Base64-encoded PowerShell command when the visitor clicked the checkbox. Its HTML also contained a macOS branch with Command+Space, Terminal, paste and Enter instructions.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October so far | 122 |
99% of TableFrame sites captured since 25 September run WordPress. 107 TableFrame sites also carry LenAI, so removal work should look for both independent injections.
Checking the injected and loaded stages
Search HTML, first-party JavaScript and generated data: scripts for:
- a script element loading
/cT.js encode(table, data)andtable.substring(char * 2, char * 2 + 2)- a fingerprint containing
theme,timezone,resolution,storageandwebdriver randomCase(data)immediately before a request- a 32-character hexadecimal sentinel comparison
- returned HTML passed to
insertAdjacentHTML("beforeend", html) - message handlers for the literal values
cookieandreload
Compare the end of large theme and plugin scripts with clean vendor copies. Retained pages append both the small first stage and the full loader after legitimate code.