NewsPublished 18 Sep 2026

Clickfix URL

Source Reddit Cybersecurity

Discussion

A suspicious URL (https://xysrx.com/PV.js) was found embedded below the closing HTML tag on the homepage of a website serving Clickfix. The JavaScript code fetched from this URL collects visitor environment data such as theme preference, timezone, screen resolution, and browser automation status, encodes this data, and conditionally injects additional HTML content triggered by user interactions like mouse clicks. This behavior suggests potential unauthorized content injection or tracking. No official vendor advisory or patch information is available.

r/cybersecurity (opens in a new tab)u/ScottHot0 points0 comments

A website serving clickfix had this URL at the bottom of the homepage, below the closing html tag: https://xysrx.com/PV.js

I've reported this URL - just submitting it here in case it's helpful to anyone.

Links cited in the discussion

https://xysrx.com/PV.js

Impact

The injected script collects detailed client environment information and dynamically injects HTML content based on user interaction, which could be used for tracking, fingerprinting, or delivering unwanted or malicious content. However, no direct evidence of exploitation or malicious payloads is provided. The impact is medium severity due to potential privacy concerns and possible unauthorized content injection.

Defensive guidance

Since no official advisory or patch is available, it is recommended to investigate the source of the embedded URL on the affected website, remove unauthorized script inclusions, and monitor for suspicious external resource calls. If this is part of a third-party service, contact the service provider for clarification and remediation.

Summary

The threat involves a JavaScript resource hosted at https://xysrx.com/PV.js, discovered embedded in the Clickfix website. The script collects various client environment parameters (color scheme, timezone, screen dimensions, device pixel ratio, localStorage availability, and webdriver presence) and encodes this data using a custom encoding function. It then sends this encoded data to the remote server and, based on the server's response, injects HTML content into the page triggered by user events such as mouse clicks. The script also manages cookies to limit repeated triggering. The exact nature of the injected content is not detailed, but the behavior indicates potential for unwanted content injection or tracking. No known exploits or vendor advisories are provided.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 18 Sep 2026, 15:31 UTC

Technical details

References

Community reviews