What Gridinsoft observed on bpos.org
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261026115907-e0710121
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- ClickFix loader
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
Current linked code contains a deceptive verification flow that induces execution of remote content. This finding concerns code served through the society website; it does not establish intentional fraud by the society or a completed infection of any visitor.
Analyst findings
Review 3 documented observations View evidence
The apex redirects to the British Psychosocial Oncology Society website. IPOS independently links this exact website in its UK federation directory. Public pages describe the society, membership and its own sign-in; payment forms refer to Stripe. No account, membership payment or private member record was tested. A legitimate society identity does not establish that all served code is benign.
- Public artifact URL https://www.bpos.org/
- Public artifact URL https://www.ipos-society.org/federation/uk
The current HTML loads health-probe.js from a site-helper plugin and supplies a Base contract address. The retrieved script can execute enabled contract-supplied JavaScript; when none runs, its fallback requests the contract demo page and is programmed to place it in a full-screen iframe for Windows or macOS visitors, once per day.
- Public artifact URL https://www.bpos.org/wp-content/plugins/site-helper-fa691dda0935/assets/health-probe.js
- Public artifact URL https://www.bpos.org/
Read-only Base calls at block 53111618 retrieved an available HTML demo page. The named script entries were disabled, but the local fallback still selects that page. Its source imitates Google human verification, copies an mshta remote-content launcher to the clipboard on a checkbox click, and tells Windows users to paste it into Run. This is a deceptive command-execution flow in retrieved code. The JavaScript, command and remote endpoint were not executed or fetched as a payload.
- Public artifact URL https://basescan.org/address/0x58460d0b3d4d6b03761c89120393c0c676676496
- Public artifact URL https://basescan.org/block/53111618
Scope and limitations
- No remote launcher payload was downloaded or run, visitor infection or credential theft reproduced, or complete server/WordPress audit performed. The claimed scanner results and the origin or authorization of the plugin were not independently authenticated.
Help protect others by sharing this page on social media! The more people who know about bpos.org, the fewer chances they have to deceive someone else. Help others evaluate bpos.org by sharing this page on social media!