ClickFix Uses EtherHiding & GULoader Campaign Infect

Windows users are currently facing a new cyberattack campaign. This operation exploits fake CAPTCHA pages and combines three distinct techniques to slip past standard security defenses, effectively avoiding detection.

The campaign, first observed in April 2026, begins on a compromised European small-business website and ends with an attempt to load GULoader, a memory-based malware downloader, onto a victim’s machine.

What makes this attack dangerous is how naturally it blends into normal browsing, deceiving both users and automated security tools.

The attack targets users who arrive at a legitimate-looking website through a Google search, with no phishing email or suspicious link involved.

The website functions exactly as expected, with product pages, contact forms, and maps all working normally. Malicious code hidden in the site’s WordPress backend quietly waits to activate under the right conditions.

Analysts at Sicuranext identified this intrusion and documented the full attack path. According to Sicuranext report shared with Cyber Security News (CSN), the campaign chains a compromised WordPress site, a blockchain-based payload method called EtherHiding, a social engineering trick called ClickFix, and a remote loader attributed to GULoader.

Every layer is built to appear legitimate, giving most traditional defenses no reason to intervene. The infected site targets only desktop Windows browsers.

Anyone visiting from a phone or a security scanner sees a perfectly clean page, hiding the attack from site owners, search engines, and automated monitors.

Only a real Windows user at a desktop triggers the payload, making this campaign very hard to detect through routine checks.

In this specific incident, behavioral detection stopped the attack in under 300 milliseconds before GULoader could load. The campaign still came dangerously close to succeeding and exposed real gaps in how organizations defend against this type of threat.

ClickFix Campaign Uses EtherHiding and GULoader

The attack begins the moment the victim lands on the compromised page. Within two seconds, injected JavaScript silently contacts the BNB Smart Chain Testnet, a free public blockchain, to fetch a malicious payload stored in a smart contract.

This technique, known as EtherHiding, is hard to block because requests travel through trusted providers like Cloudflare, and blockchain data cannot be removed through abuse reports.

Once retrieved, the payload displays a fake reCAPTCHA overlay on the legitimate page. The overlay tells the user to press Win+R, Ctrl+V, and Enter, shortcuts that open the Windows Run dialog and paste a command.

Unknown to the user, the clipboard was already loaded with a malicious instruction via a built-in browser function, and the victim runs it willingly, believing it to be a routine check.

The command calls rundll32.exe, a trusted signed Windows tool, pointing it to a remote DLL hosted by the attacker over a UNC path. Because rundll32.exe is a Microsoft-signed binary, it clears SmartScreen without any warning.

The DLL loads directly into memory with no file written to disk and no prompt shown, bypassing antivirus tools that scan files before execution.

GULoader Delivery and Behavioral Detection

The C2 domain in this campaign, autum-path[.]vo8xalon[.]in[.]net, is attributed to GULoader based on threat intelligence reporting.

GULoader is a shellcode-based loader running entirely in memory, commonly used to drop infostealers like Lumma and Vidar and remote access tools such as Remcos and AgentTesla. A successful execution could have led to credential theft or full remote control of the victim’s machine.

A behavioral rule targeting rundll32.exe with unusual arguments and ordinal-based function calls flagged and killed the process within 300 milliseconds.

Post-incident checks confirmed no child processes were spawned, no data was exfiltrated, and no lateral movement occurred. The user’s credentials were reset and all active sessions were ended as a precaution.

Security teams are advised to block outbound SMB traffic on port 445 and consider disabling the WebClient service on workstations that do not need WebDAV.

Monitoring DNS queries to blockchain RPC domains from browser processes is strongly recommended. Searching the Windows Run dialog history for rundll32 or UNC path entries can also help surface early signs of compromise.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.