Screamer Cactus

		Content Warning! The following work contains content and material that some may find shocking. Reader discretion is advised.

Screamer Cactus is a French shock site created by PyjamaSam. It was first described on a Jeuxvideo.com forum by the creator on April 7, 2012.

Content

The site contains a picture of a man with a cactus inserted inside his anus, with a small drop of semen coming out of his penis. The malicious website exploits an automated script along with an embedded Flash file named out.swf to flood the victim's browser with an endless number of tabs.

Once opened, the malicious web pages performed the following actions:

• It played the first 28 seconds of the song "The Cadillac Theory" by Stupeflip. in a continuous, heavily distorted audio loop.
• Triggered JavaScript fullscreen mode to hide browser controls and hinder the user's ability to close the tabs.
• Applied CSS styling to hide the mouse cursor, making it more difficult to interact with or close the window easily.

The code functioned identically to Last Measure. For example, the page utilized a recursive JavaScript function named caca (French for "poop") that repeatedly spawned alert boxes containing the text "CAACACAAA" effectively freezing the browser.

History

Following its release in 2012, Screamer Cactus was quickly adopted for raids on Twitter. The tool is widely believed to have been influenced by Blabla 15-18 ans ("15-18 years [old]"), a notorious raid group from jeuxvideo.com once the most active forum on the French web, and by some accounts, in Europe.

By early 2016, a small elite team began roaming Twitch to use "Cactus Screamers" during livestreams. This team eventually grew and laid the groundwork for Twitch Booster, a malicious variant of Screamer Cactus. On April 8, 2016, a streamer named Takeru_46 opened the Screamer Cactus during one of his livestreams. The page stayed open on the broadcast for over four minutes before he managed to close it.

The first URL created for Screamer Cactus was 0xad.net/cactus, named after the creator's alias, 0xad. During 2012, it was temporarily hosted on the ownage.fr website managed by Unifiedlinux which helped further publicize it until April 28, 2013. Other forum users subsequently created alternate domains that redirected to the original site. Most notably, KebabFries registered a domain named after his own screamer website Noelshack.com.free.fr specifically mimicking a typo (Noelshack.comm.free.fr missing an m) which redirected visitors straight to 0xad's URL.

Cactus Note

The Cactus Note was a "notebook" and urban legend originating from the 18-25 group during the "War Forum." According to jvflux.fr, whoever possesses it gains the terrifying power to curse anyone simply by recording their online handle. Cactus Note was essentially a parody of Death Note, except the rules dictate that if a handle remains on the page for more than forty seconds, the unfortunate soul is doomed to be startled by the Screamer Cactus in real life.

Twitch Booster

One and only destructive Twitch Booster mid-payload.

Twitch Booster was a destructive piece of malware created between 2016 and 2017. It was made by Jewstice of 18-25 forum, a group succeeding the 15-18. It lures people by masquerading as a growth tool designed to "boost" their Twitch or YouTube channels. Once executed, the software immediately displayed annoying pop-ups of Screamer Cactus and initiated several other payloads, ultimately rendering the user's computer completely unbootable. Twitch Booster was sometimes referred to as the Risitas virus or the 18-25 virus.

Upon launch on granted administrator privileges, the malware begins a fake installation process accompanied by a 60-second waiting period during which mouse clicks were intentionally reversed. Simultaneously, a Microsoft text-to-speech voice declared in French:

"Hello, I'm just the little voice that tells you that 18-25 has just destroyed your PC forever. Have fun fixing it, very happy. Dedicated to the kheys of 18-25." (Dans 5 minutes tu n'as plus de PC fils de viol, le 18-25 t'a bien baiser le cul :))

Following this, a secondary payload unleashed a relentless flood of message boxes titled "The Elite of the Nation," each displaying the text: "THE 18-25 FUCKED YOU WELL THE ASS OF A BIG SON OF A BITCH." (LE 18-25 T'A BIEN BAISER LE FION PUTAIN DE GROS FILS DE PUTE) As the message boxes appears, the virus silently stripped critical system files from the C: drive and triggered a five-minute countdown timer. A separate warning flashed: "In 5 minutes you no longer have a PC son of rape, the 18-25 fucked you well the ass:)" (Dans 5 minutes tu n'as plus de PC fils de viol, le 18-25 t'a bien baiser le cul :)) During this window, automated scripts spawned countless browser tabs, filling the display with Screamer Cactus.

The malware replaced the desktop wallpaper with an image of Spanish comedian El Risitas holding a custom-commissioned cardboard sign dedicated to the creators of the malware (18-25 group from Jeuxvideo.com). Simultaneously, it applied a melting visual effect across the display (similar to Email-Worm.Win32.MeltingScreen) and looped the remix track Issou Night Club by Remi Flip. Additionally, it forced the CD tray into an infinite ejection loop and used a background VBS script via the SendKeys function to flash the keyboard LEDs rapidly every 100 milliseconds.

Before ultimately restarting the PC with a shutdown message mid-chaos, the malware overwrote the computer's Master Boot Record with a custom Snake game retrieved from the OSDev.org forum. Because this game launched in place of the operating system on the subsequent reboot, the system was left completely bricked and unable to load Windows.

Links

NOTE: The following shock sites contain graphic images, as well as a malicious script that may harm your device!

• 0xad.net/cactus
• web.archive.org/web/20150219012946/get-cooki.es
• web.archive.org/web/20140214222521/ownage.fr
• web.archive.org/web/20130501153541/pwned.fr
• web.archive.org/web/20140421050951/eofroro.tk
• web.archive.org/web/20161012234903/underporn.fr/cactus
• Source Code

Soundtrack

• screamer.wiki/File:Cactus_screamer_musique.mp3

Hidden Links

• web.archive.org/web/20211025222740/bexandre.alwaysdata.net/cactus
• image.noelshack.com.free.fr/fichiers/2012/52/1356820092-cisla.jpg
• thomasbh.tumblr.com
• jeuxvideo.digidip.net/visit?url=http%3A%2F%2Fimage.noelshack.com.free.fr%2Ffichiers%2F2012%2F52%2F1356820092-cisla.jpg&ppref=http%3A%2F%2Fwww.jeuxvideo.com%2Frecherche%2Fforums%2F0-51-0-1-0-1-0-blabla-18-25-ans.htm%3Fsearch_in_forum%3Dbite%26type_search_in_forum%3Dtitre_topic
• lc.cx/jk9
• urlz.fr/ASU
• bit.ly/NRJ-LIVE-128kbps
• goo.gl/HGUfVR
• tinyurl.com/kftd2bg
• bit.ly/1mhZq80

See also

• Last Measure - A series of websites with similar behavior.

Comments

Comments

Loading comments...