Executive Summary
A sophisticated ClickFix campaign is currently targeting users through a large-scale compromise of WordPress websites, likely exploiting a critical vulnerability chain in versions 7.0.2 and 7.0.3. The attack chain utilizes 'EtherHiding,' a technique where malicious JavaScript is hosted within Ethereum smart contracts on the Sepolia testnet to evade traditional domain-based detection. Victims are led through a fake browser verification flow that tricks them into executing PowerShell commands.
The technical workflow involves multiple layers of obfuscation, including AES-GCM encrypted payloads and the use of Cloudflare R2 for malware hosting. The final payload is a Python-based remote access tool (RAT) packaged with Inno Setup. Notably, the malware also uses blockchain infrastructure to locate its command-and-control (C2) servers and employs DNS-based tunneling that mimics Microsoft traffic for exfiltration.
This campaign represents a significant threat due to its high agility and use of decentralized infrastructure. By hosting core logic on the blockchain and using randomized subdomains on legitimate platforms like Cloudflare, attackers ensure that traditional blocklists and site cleanups are insufficient to stop the threat.