Best Detection of 2026 Series: EtherHiding Blockchain-Hosted ClickFix Payload Re

Ibrahim Saud@tektrix

•updated Sep 27, 2026•1•0•4

Detects endpoint-based retrieval of potential malicious payloads or configurations from blockchain-hosted infrastructure (e.g., Infura, Alchemy, public RPC nodes) using web-based RPC calls, followed by the execution of a script interpreter (e.g., PowerShell, WScript, MSHTA). This pattern is characteristic of 'EtherHiding' campaigns where smart contracts are used as decentralized and takedown-resistant storage for second-stage delivery.