VerifyFork ClickFix kit
VerifyFork is a ClickFix loader that takes a script or redirect address from controller JSON. We have matched it on 5 sites since 10 October.
VerifyFork in numbers
Since 10 October, the first VerifyFork match in our records, counted on 13 October 2026. How we count.
| Sites with VerifyFork code | 5 |
|---|---|
| Most recent match | 11 October |
| Sites captured since 25 September | 5 |
| Sites running WordPress | 5 |
A verified flag gates the loader
VerifyFork sits in the site's HTML and in theme JavaScript files. Before contacting its controller, it reads a verified expiry timestamp from local storage. A visit with a verified query parameter writes a new expiry. A later visit without that parameter skips the loader until the stored value expires.
The script checks the visitor's operating system, browser version, language list and window dimensions. It stops on crawler user agents, navigator.webdriver, headless browsers and automation markers in the window. Desktop browsers must pass a browser-version check before the controller request runs.
Controller JSON picks the next step
The loader reconstructs hxxps://clickhitriver[.]com/api/data from character codes and nested Base64. It requests JSON with cache: 'no-store' and credentials: 'omit', and retries failed requests.
A script field is passed to new Function and executed. A url field sends the browser elsewhere through location.replace. Before that redirect, the loader adds the current site's hostname as a Base64 domain parameter and its favicon address as a Base64 link parameter.
What we see
Among successful captures since 25 September, 5 of 5 VerifyFork sites ran WordPress.
Checking a site
Compare the page source and theme JavaScript with trusted copies. Look for:
- a
verifiedlocal-storage value treated as an expiry timestamp - a
verifiedquery parameter that renews that value - requests to
clickhitriver[.]com/api/data - controller JSON passed to
new Functionthrough ascriptfield - redirects that add Base64
domainand faviconlinkparameters - browser-version and automation checks ahead of the request
Remove the injected script and cached copies, then review administrator and hosting access and rotate those credentials. Test from a clean browser profile so the stored verification flag does not suppress the loader.