TwinKey ClickFix kit

TwinKey is a two-key wrapper whose decoded stage reads a script host from Polygon. We have matched it on 39 sites since 8 September.

Research by Kirk

TwinKey in numbers

Since 8 September, the first TwinKey match in our records, counted on 12 October 2026. How we count.

Sites with TwinKey code	39
Sites with a match in the last 30 days	38
New sites in September	35
Still serving it when recaptured at least 25 days later	2 of 3 sites (67%)
Sites running WordPress (captured since 25 September)	86%

Two keys unwrap the resolver

TwinKey is our name for an inline wrapper that rebuilds the name fromCharCode from split strings. It applies two repeating string keys to an embedded byte sequence, converts the result to text and writes that text into a temporary script element. The wrapper removes the temporary element and its own script tag after the decoded code runs.

An audit decoded 84 TwinKey payloads in 51 retained responses from 36 sites. The outer variable names change across copies. The paired keys, rebuilt function name and temporary-script cleanup remain useful markers.

The scheduler and requested path changed

One generation waits for requestIdleCallback. Another uses requestAnimationFrame and the String constructor. Both decode a resolver that calls the same Polygon contract and selector:

Contract	Chain	Selector
`0xb6BE32f00cD80b27ed2B94c10dce991d0D27aef0`	Polygon	`0xb68d1809`

The contract response supplies a base address. The resolver adds a randomised path below /api/ and injects the result as a script. Retained copies use /api/index or /api/vendor_lib, with extensions including .js, .avi and .css.

In three production captures, those randomised requests received a captcha-themed 404 page. That response leaves a useful network trace even when the requested filename changes.

What we see

Month	New sites
September	35
October so far	4

The persistence check found TwinKey again on 2 of 3 sites recaptured at least 25 days after their first match (67%). 86% of TwinKey sites captured since 25 September run WordPress.

TwinKey overlaps with BW Panel on 28 sites and with LA02 on 10. Its dual-key wrapper and Polygon selector separate this family from those neighbouring injections.

Checking a site

Search raw HTML and decoded inline scripts for:

fromCharCode assembled from several short strings
two repeating string keys applied to one embedded byte sequence
decodeURIComponent(escape(...)) around the decoded text
a temporary script populated through textContent and then removed
a Polygon call to the contract above
randomised /api/index or /api/vendor_lib requests

Decode several copies before comparing them. Scheduling calls, variable names and extensions rotate while the inner contract resolver remains recognisable.