Executive Summary
A sophisticated ClickFix campaign has been identified targeting Windows users through compromised WordPress sites. The attack chain begins with a social engineering lure mimicking a verification check, instructing users to execute a PowerShell command via the Win+X menu to bypass traditional Run dialog monitoring.
Technically, the campaign leverages 'EtherHiding,' where the malicious overlay is hosted within smart contracts on the BNB Smart Chain (BSC) testnet. This allows attackers to rotate infrastructure seamlessly. The execution flow utilizes jsDelivr and GitHub for stager delivery, followed by a heavy 6MB XOR-encoded PowerShell script that employs Early Bird APC injection to reflectively load an undetected payload masquerading as a Realtek HD Audio Manager.
This campaign demonstrates high operational maturity by rotating GitHub accounts (e.g., werd19327, xvcbbdg38465) and C2 domains, effectively evading static analysis and domain reputation filters. The use of signed Microsoft processes for final stage execution increases the difficulty of endpoint detection.