EtherHiding ClickFix

EtherHiding ClickFix is a malware-delivery pattern, not a single campaign: it fuses ClickFix (a fake-CAPTCHA / "verify you are human" prompt that tricks a victim into pressing Win+R or opening Terminal, pasting a clipboard-hijacked command, and executing it — MITRE T1204.004) with EtherHiding (storing the live command-and-control address inside a public blockchain smart contract — chiefly Polygon, also observed on BNB Smart Chain — so operators rotate infrastructure with a single on-chain transaction instead of re-infecting every compromised site). Between March and August 2026 at least six independent vendors — Cribl SecOps, AllSecure, LevelBlue SpiderLabs, PhishEye, FileScan.io/OPSWAT, and Cynet — documented distinct operator clusters running this pattern, most originating from compromised WordPress sites (injected script in robots.txt, page footers, or must-use plugins) and distributing payloads ranging from commodity infostealers (Vidar) and loaders (GULoader, HijackLoader) to a custom RAT (Starland RAT) and, in AllSecure's research, a backdoor plus malicious browser extension pair whose tradecraft aligns with DPRK cluster UNC5342 / Contagious Interview.

The one step common to every reported variant is the user-driven paste-and-run action itself — the smart-contract lookup happens silently in the browser before the victim ever sees a prompt, so Falcon's earliest reliable signal is the process spawned immediately afterward (explorer.exe/Terminal → PowerShell/cmd/mshta/rundll32 with a hidden window and an iex(irm ...) or UNC-path pattern). Because the C2 configuration layer lives on-chain, domain and IP blocking alone under-serves this threat: a takedown only removes one disposable front-end while the contract — and the attacker's ability to repoint every future execution — persists.

Defender priority: Detect the paste-and-run execution pattern (Q1/Q2) as the highest-fidelity, lowest-effort control; pair it with outbound monitoring for public blockchain RPC calls from non-developer endpoints (Q3) and a standing user-awareness message that no legitimate site ever asks for Win+R-and-paste. Treat any host that executed the pasted command as compromised — rotate credentials and cryptocurrency wallet keys reachable from that endpoint before declaring the incident closed.

Web-hunter note: "EtherHiding ClickFix" spans at least five independently reported operator clusters sharing the same technique but distinct infrastructure (different contracts, wallets, and function selectors). This pack treats the AllSecure/GBHackers DPRK-linked instance as the flagship IOC set (matches this build's source brief exactly) and carries the other clusters as corroborating, separately-labeled "related infrastructure" — do not merge their atomic indicators into one campaign identity. No text addressed to an AI/assistant was found in any fetched source; all fetched content was treated strictly as research material.

Hunt hypotheses

1. H1 · High: A host whose Run dialog or Terminal spawns a shell/scripting interpreter immediately after explorer.exe/Terminal, carrying an iex(irm ...)-style download-and-execute pattern, indicates ClickFix paste-and-run.
2. H2 · High: PowerShell launched with a hidden window flag combined with Invoke-RestMethod/iex is a distinctive fingerprint of the ClickFix stager fetch documented independently by FileScan.io and Cribl.
3. H3 · Medium: Outbound DNS/HTTP calls to public blockchain RPC endpoints from a browser-spawned or script-hosting process (not a known Web3/dev tool) indicate live EtherHiding contract resolution.
4. H4 · High: rundll32.exe loading a DLL via a UNC path with an ordinal export is the documented GULoader/ClickFix LOLBin execution stage.
5. H5 · High: DNS lookups for the specific atomic stager/C2 domains published across these sources are a direct, high-confidence hit.
6. H6 · Medium: A schtasks.exe-created task running every minute, spawned from a Run-dialog PowerShell one-liner, matches the Starland RAT persistence pattern.
7. H7 · Medium: A Node.js process launched from Terminal/shell shortly after a ClickFix Terminal paste, running from a cache/temp path outside normal developer tooling, matches the AllSecure macOS RAT loader.
8. H8 · Medium: A newly-written DLL loaded immediately by a process spawned from msiexec.exe matches the HijackLoader-style sideload chain documented by Cynet.

Attack chain

Flagship instance (AllSecure / GBHackers — macOS ClickFix → Terminal → Node.js RAT + malicious Chrome extension; tradecraft aligned to DPRK UNC5342 / Contagious Interview):

Related infrastructure — independently reported EtherHiding-ClickFix clusters, kept source-tagged and separate from the flagship set above:

Domains and stager URLs in this family rotate on the order of days (FileScan.io measured 2–7 day cadence; PhishEye measured 97 domains across one campaign window). Treat every domain/URL row as perishable — the Ethereum/Polygon contract addresses are the durable pivot, not the domains they currently resolve to.

These checks live outside Falcon's endpoint event stream — on the web server, the domain-name system, or the browser-management console — and cover the steps of the chain (1, 3, 6-extension) that Falcon endpoint telemetry does not directly see.

1. PowerShell ScriptBlock logging (Event ID 4104): if not already enabled fleet-wide, turn it on and search for the -w h/-windowstyle hidden + iex(irm ...) fingerprint. This is the same signature Q2 hunts in Falcon telemetry, but 4104 captures the fully deobfuscated script block text, which is useful when the CommandLine itself is truncated or further obfuscated.
2. WordPress site integrity (organization-owned properties only): scan robots.txt, theme header.php/footer.php/functions.php, and the mu-plugins directory for injected <script> blocks containing fromCharCode, atob(, createElement("script"), or outbound fetch()/XMLHttpRequest calls to RPC-sounding hostnames. Specifically check for an unfamiliar session-manager.php-style file in mu-plugins — LevelBlue's documented ErrTraffic v3 backdoor filename.
3. Web server / WAF access logs: search for a Set-Cookie: errtraffic_session= response header, and for requests matching /api/index.php?a=dl or /api/?a=tds_cfg patterns.
4. Enterprise DNS resolver logs: flag first-time lookups to blockchain RPC domains (polygon-rpc.com, publicnode.com, drpc.org, bnbchain.org, alchemyapi.io, infura.io, ankr.com, quiknode.pro) from subnets that are not your dev/Web3 team — mirrors Q3 but at the resolver instead of the endpoint, covering hosts without Falcon coverage.
5. Managed browser extension inventory (MDM/Chrome Enterprise console): review the extension allowlist/installed-extension report for IDs outside your approved catalog, and for any recent modification timestamp on Secure Preferences that doesn't correlate with a scheduled Chrome update.

Alert package — Q2 & Q4 (promotable pair)

Scheduled Search name: DETECT — ClickFix Hidden-Window PowerShell / rundll32 UNC LOLBin (EtherHiding Delivery Chain)
Description: Fires when a host executes the hidden-window iex(irm) PowerShell fingerprint or a UNC-path rundll32 ordinal-export call — the two highest-fidelity signatures for the ClickFix paste-and-run stage documented across the EtherHiding-ClickFix vendor reporting.
Alert email subject: [HIGH] Detection: EtherHiding ClickFix — hidden-window stager execution on <ComputerName>
Alert email body: A host matched the ClickFix/EtherHiding stager-execution fingerprint (hidden-window PowerShell IEX/IRM, or a UNC-path rundll32 ordinal call). This pattern is associated with a blockchain-hidden C2 delivery chain that has recently distributed infostealers, loaders, and RATs. Treat the endpoint as potentially compromised until triaged — the user executing this command most likely pasted it from a fake CAPTCHA/verification prompt. Immediate actions: network-contain the host, capture the full CommandLine and any child-process tree, and identify the site/prompt the user interacted with just prior to execution.
Triage checklist:

1. Pull the full ProcessRollup2 record and confirm the parent is explorer.exe (Windows Run dialog) or Terminal (macOS)
2. Interview the user: what page/prompt told them to press Win+R or open Terminal and paste?
3. Check NetworkConnectIP4/DnsRequest for the affected host in the surrounding 5 minutes for RPC-endpoint or known stager-domain traffic (pivot: Q3, Q5)
4. Check for a resulting NewExecutableWritten event (secondary payload drop) on the same host (pivot: Q8)
5. Check for a resulting scheduled task or startup persistence artifact (pivot: Q6)
6. If browser credentials or a cryptocurrency wallet are present on the host, treat them as compromised — begin rotation immediately
7. Network-contain the host if not already isolated; preserve the process/network evidence before remediation
8. Escalate to IR if any child process wrote an executable, established outbound C2, or created persistence

Pivot queries: host-scoped — re-run Q3/Q5/Q6/Q8 with aid = <affected_aid>; environment-wide — re-run Q1–Q8 across the fleet for the same 7-day window to scope additional victims.

Lighter package — Q1, Q3, Q6, Q7, Q8 (investigate-only)

No alert email; run as scheduled hunts. Pivot queries: for any hit, join back to Q5 (known domains) and Q3 (RPC calls) on the same host/time window to confirm the full chain before escalating.

Never validate by visiting an actual reported ClickFix lure page or pasting a captured attacker command, even in a lab — several variants fetch a live second-stage payload from rotating infrastructure that cannot be fully controlled by the analyst.

Playbook 1 — Enable PowerShell Script Block Logging (GPO)

Step 1: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > "Turn on PowerShell Script Block Logging" = Enabled; link the GPO to the target OU.

Set-GPRegistryValue -Name "EtherHiding-ClickFix-ScriptBlockLogging" `
  -Key "HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
  -ValueName "EnableScriptBlockLogging" -Type DWord -Value 1

Prerequisites: Domain Admin rights, GPMC access, target OU identified.
Reboot required: No — run gpupdate /force and open a new PowerShell session.
Rollback: Set the policy back to Not Configured/Disabled and run gpupdate /force; purely a logging toggle, no data loss.

Playbook 2 — ASR rule: block execution of potentially obfuscated scripts

# Pilot (Audit) first
Set-MpPreference -AttackSurfaceReductionRules_Ids 5beb7efe-fd9a-4556-801d-275e5ffc04cc `
  -AttackSurfaceReductionRules_Actions AuditMode

# After pilot review, move to enforcement
Set-MpPreference -AttackSurfaceReductionRules_Ids 5beb7efe-fd9a-4556-801d-275e5ffc04cc `
  -AttackSurfaceReductionRules_Actions Enabled

Prerequisites: Microsoft Defender Antivirus active as (or alongside) the primary AV, Windows 10 1709+/Server 2019+, pilot ring identified.
Reboot required: No.
Rollback: Set-MpPreference -AttackSurfaceReductionRules_Ids 5beb7efe-fd9a-4556-801d-275e5ffc04cc -AttackSurfaceReductionRules_Actions Disabled

Playbook 3 — Disable the WebClient (WebDAV) service

\# Survey for dependency first, then:
Set-Service -Name WebClient -StartupType Disabled
Stop-Service -Name WebClient -Force

Prerequisites: Confirm no business-critical WebDAV-mapped drives depend on the service (survey the target population first).
Reboot required: No, though users with open WebDAV handles should close them first to avoid an in-flight-transfer interruption.
Rollback: Set-Service -Name WebClient -StartupType Manual; Start-Service -Name WebClient

Playbook 4 — Perimeter block for public blockchain RPC domains

# Example generic proxy/firewall ACL syntax -- adapt to your platform
deny dst-domain-category "blockchain-rpc" src-group "all" exclude-group "web3-dev-team"
deny dst-domain "polygon-rpc.com,publicnode.com,drpc.org,bnbchain.org,alchemyapi.io,infura.io,ankr.com,quiknode.pro" src-group "all" exclude-group "web3-dev-team"

Prerequisites: Identify and document the dev/Web3 allowlist group before deployment — this is the single biggest source of legitimate breakage.
Reboot required: No.
Rollback: Remove the deny rule / re-enable resolution for the affected domain category.

Before promoting any query past investigate-only, confirm the Detection Validation Gates in §11 (telemetry readiness, benign baseline, positive test, IOC freshness) have all passed for your tenant.

Tradecraft in the flagship instance is reported to align with DPRK cluster UNC5342 / Contagious Interview per AllSecure's analysis. This is a distinct delivery/C2 mechanism (ClickFix + blockchain-hosted EtherHiding C2) from the already-published Contagious Interview / BeaverTail HuntPack, which covers fake job-interview coding-challenge delivery via npm/PyPI — the two packs should be run together for full UNC5342-linked coverage but do not overlap in detection content.