ClickFix Campaign Infects Windows Users With EtherHiding, GULoader

Key Takeaways

• A new campaign, dubbed “ClickFix,” is actively targeting Windows users by combining fake CAPTCHA pages with sophisticated evasion techniques.
• The attack chain leverages compromised WordPress sites, the blockchain-based EtherHiding method, and social engineering to deliver the memory-resident GULoader malware.
• The campaign specifically targets desktop Windows browsers, bypassing detection by security scanners and mobile devices, making it difficult to identify through standard checks.
• While behavioral detection successfully halted a recent incident, the attack highlights critical vulnerabilities in traditional security defenses against advanced, blended threats.

Sophisticated ClickFix Campaign Targets Windows Users with EtherHiding and GULoader

A novel cyberattack campaign is actively exploiting Windows users, employing a multi-layered approach that includes deceptive CAPTCHA pages and advanced techniques to circumvent conventional security measures. This operation, which analysts first observed in April 2026, initiates on a compromised European small-business website and culminates in an attempt to deploy GULoader, a memory-based malware downloader, onto victims’ systems.

The campaign’s inherent danger lies in its seamless integration with legitimate web browsing, effectively deceiving both end-users and automated security tools. Unlike typical phishing attempts, this attack ensnares users who navigate to seemingly legitimate websites via standard Google searches, eliminating the red flags associated with suspicious emails or links.

The compromised websites function normally, with all expected features like product pages, contact forms, and maps operating without issue. Malicious code, embedded within the site’s WordPress backend, remains dormant, activating only under specific conditions.

Security researchers at Sicuranext meticulously documented this intrusion, outlining the full attack path. Their report, shared with Cyber Security News (CSN), details how the campaign orchestrates a chain involving a compromised WordPress site, a blockchain-based payload delivery mechanism known as EtherHiding, the social engineering tactic dubbed ClickFix, and the remote loader attributed to GULoader.

Each stage of the attack is meticulously crafted to appear legitimate, offering minimal cues for traditional defenses to intervene. The infected sites exclusively target desktop Windows browsers. Mobile users or automated security scanners encounter a perfectly clean webpage, effectively concealing the malicious activity from site owners, search engines, and monitoring systems. Only a genuine Windows user on a desktop environment can trigger the malicious payload, rendering this campaign exceptionally difficult to detect through routine scans.

In a recent incident, behavioral detection successfully neutralized the attack within 300 milliseconds, preventing GULoader from fully deploying. Despite this success, the campaign’s near-triumph exposed significant gaps in current organizational defenses against such sophisticated, blended threats.

ClickFix Campaign Leverages EtherHiding and Social Engineering

The attack sequence begins the moment a victim accesses the compromised webpage. Within two seconds, stealthily injected JavaScript code establishes contact with the BNB Smart Chain Testnet, a public blockchain, to retrieve a malicious payload stored within a smart contract. This technique, known as EtherHiding, poses a formidable challenge for blocking, as requests are routed through trusted content delivery networks like Cloudflare, and blockchain data is immutable, preventing removal via abuse reports.

Upon retrieval, the payload displays a deceptive reCAPTCHA overlay on the otherwise legitimate page. This overlay instructs the user to press Win+R, Ctrl+V, and Enter—a sequence of shortcuts designed to open the Windows Run dialog and paste a command. Unbeknownst to the victim, their clipboard has already been populated with a malicious instruction via a built-in browser function, leading them to willingly execute the command under the false impression of performing a routine security check.

The executed command invokes rundll32.exe, a legitimate and signed Windows utility, directing it to a remote DLL hosted by the attacker over a UNC path. Because rundll32.exe is a Microsoft-signed binary, it bypasses Windows SmartScreen warnings without raising any alerts. The malicious DLL then loads directly into memory, without writing any files to disk or displaying prompts, thereby evading antivirus solutions that primarily scan files before execution.

GULoader Delivery and Behavioral Detection

Threat intelligence reports attribute the C2 domain used in this campaign, autum-path[.]vo8xalon[.]in[.]net, to GULoader. GULoader is a shellcode-based loader that operates entirely in memory, frequently employed to distribute information stealer malware such as Lumma and Vidar, as well as remote access tools like Remcos and AgentTesla. A successful execution of GULoader could have resulted in credential theft or complete remote control over the victim’s machine.

In the observed incident, a behavioral rule specifically designed to detect rundll32.exe being invoked with unusual arguments and ordinal-based function calls successfully identified and terminated the malicious process within 300 milliseconds. Post-incident analysis confirmed that no child processes were spawned, no data exfiltration occurred, and no lateral movement was detected. As a precautionary measure, the user’s credentials were reset, and all active sessions were terminated.

What You Should Do

• Block Outbound SMB Traffic: Configure firewalls to block outbound SMB traffic on port 445 from workstations to prevent UNC path exploitation.
• Disable WebClient Service: Consider disabling the WebClient service on workstations where WebDAV functionality is not essential.
• Monitor DNS Queries: Implement monitoring for DNS queries originating from browser processes to blockchain RPC domains (e.g., bsc-testnet[.]drpc[.]org) to detect EtherHiding attempts.
• Review Windows Run Dialog History: Regularly check the Windows Run dialog history for entries containing “rundll32” or UNC paths as an early indicator of compromise.
• Enhance Behavioral Detection: Strengthen behavioral detection rules to identify suspicious process invocations, particularly those involving trusted binaries like rundll32.exe with unusual arguments or network connections.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.