EtherHiding ClickFix Campaign (Compromised Sites Serving Blockchain-Hosted Payloads)

Technical Analysis

The campaign compromises vulnerable CMS-based sites (commonly WordPress) via known plugin/theme vulnerabilities or stolen credentials, injecting malicious JavaScript that displays fake human-verification prompts. Victims are socially engineered into copying and pasting attacker-supplied PowerShell or shell commands into the Windows Run dialog or terminal (the ClickFix technique), which then fetch second-stage payloads referenced via smart contract calls on BNB Smart Chain (a technique dubbed 'EtherHiding'), providing resilient, censorship-resistant C2 infrastructure. The final payloads typically include infostealers (e.g., Lumma, Vidar-class malware) or remote access trojans that harvest browser-stored credentials, session tokens, and cryptocurrency wallet data. Because ClickFix relies on manual user execution rather than software exploitation, it bypasses many endpoint and network-layer defenses that focus on file-based detection. For organizations running AI agents or LLM-based automation, any credentials or API keys stored in browser profiles, password managers, or session tokens on infected hosts (including those used by developers or operators managing agent pipelines) could be exfiltrated, enabling downstream compromise of agent orchestration platforms, cloud consoles, or model API accounts.

Affected Systems

Compromised WordPress and other CMS-based small-business websites; Windows endpoints of site visitors who execute the ClickFix clipboard-paste command via Run dialog or terminal

Indicators of Compromise

• ClickFix fake CAPTCHA/verification overlay pages injected into compromised sites
• Malicious JavaScript loaders referencing BNB Smart Chain smart contract addresses (EtherHiding C2)
• PowerShell/cmd commands delivered via clipboard-paste social engineering
• Infostealer payloads (Lumma/Vidar-class) fetched from blockchain-referenced URLs
• (Specific contract addresses, hashes, and domains not included in source summary — refer to BleepingComputer report for full IOC list)

Remediation Steps

1. 1

   Patch and Harden CMS Platforms

   Update WordPress core, plugins, and themes; remove unused plugins; enforce strong unique admin credentials and MFA to prevent site compromise.

2. 2

   Block Known ClickFix Patterns

   Deploy browser and endpoint controls that detect/block clipboard-to-Run/terminal execution patterns and warn users against pasting unknown commands.

3. 3

   Monitor Outbound Traffic to Blockchain RPC Endpoints

   Flag and inspect unusual outbound connections to BSC RPC nodes or blockchain explorer APIs from endpoints, which may indicate EtherHiding-based payload retrieval.

4. 4

   User Awareness Training

   Educate employees and site visitors about ClickFix social engineering tactics, emphasizing that legitimate CAPTCHA verification never requires pasting commands into system dialogs.

5. 5

   Credential and Session Hygiene

   Rotate credentials and API keys (including those used by AI agent tooling, cloud consoles, and dev environments) on any endpoint suspected of infection; enforce short-lived tokens and MFA.

6. 6

   Endpoint Detection for Infostealers

   Deploy EDR rules tuned to detect known infostealer families and unusual PowerShell execution chains originating from browser processes.