ClickFix Campaign Uses EtherHiding and GULoader to Infect Windows Users via Fake CAPTCHA

Discover more Antivirus & Malware VPN & Remote Access Hacking & Cracking HomeCyber Security News ClickFix Campaign Uses EtherHiding and GULoader to Infect Windows Users via Fake CAPTCHA By Tushar Subhra Dutta June 17, 2026 A new cyberattack campaign is targeting Windows users through fake CAPTCHA pages, combining three techniques to slip past standard security defenses without raising alarms. The campaign, first observed in April 2026, begins on a compromised European small-business website and ends with an attempt to load GULoader, a memory-based malware downloader, onto a victim’s machine. What makes this attack dangerous is how naturally it blends into normal browsing, deceiving both users and automated security tools. The attack targets users who arrive at a legitimate-looking website through a Google search, with no phishing email or suspicious link involved. The website functions exactly as expected, with product pages, contact forms, and maps all working normally. Malicious code hidden in the site’s WordPress backend quietly waits to activate under the right conditions. Analysts at Sicuranext identified this intrusion and documented the full attack path. According to Sicuranext report shared with Cyber Security News (CSN), the campaign chains a compromised WordPress site, a blockchain-based payload method called EtherHiding, a social engineering trick called ClickFix, and a remote loader attributed to GULoader. Kill chain (Source – Sicuranext) Every layer is built to appear legitimate, giving most traditional defenses no reason to intervene. The infected site targets only desktop Windows browsers. Anyone visiting from a phone or a security scanner sees a perfectly clean page, hiding the attack from site owners, search engines, and automated monitors. Only a real Windows user at a desktop triggers the payload, making this campaign very hard to detect through routine checks. In this specific incident, behavioral detection stopped the attack in under 300 milliseconds before GULoader could load. The campaign still came dangerously close to succeeding and exposed real gaps in how organizations defend against this type of threat. ClickFix Campaign Uses EtherHiding and GULoader The attack begins the moment the victim lands on the compromised page. Within two seconds, injected JavaScript silently contacts the BNB Smart Chain Testnet, a free public blockchain, to fetch a malicious payload stored in a smart contract. This technique, known as EtherHiding, is hard to block because requests travel through trusted providers like Cloudflare, and blockchain data cannot be removed through abuse reports. Social engineering via fake CAPTCHA (Source – Sicuranext) Once retrieved, the payload displays a fake reCAPTCHA overlay on the legitimate page. The overlay tells the user to press Win+R, Ctrl+V, and Enter, shortcuts that open the Windows Run dialog and paste a command. Unknown to the user, the clipboard was already loaded with a malicious instruction via a built-in browser function, and the victim runs it willingly, believing it to be a routine check. The command calls rundll32.exe, a trusted signed Windows tool, pointing it to a remote DLL hosted by the attacker over a UNC path. Because rundll32.exe is a Microsoft-signed binary, it clears SmartScreen without any warning. The DLL loads directly into memory with no file written to disk and no prompt shown, bypassing antivirus tools that scan files before execution. GULoader Delivery and Behavioral Detection The C2 domain in this campaign, autum-path[.]vo8xalon[.]in[.]net, is attributed to GULoader based on threat intelligence reporting. GULoader is a shellcode-based loader running entirely in memory, commonly used to drop infostealers like Lumma and Vidar and remote access tools such as Remcos and AgentTesla. A successful execution could have led to credential theft or full remote control of the victim’s machine. A behavioral rule targeting rundll32.exe with unusual arguments and ordinal-based function calls flagged and killed the process within 300 milliseconds. Post-incident checks confirmed no child processes were spawned, no data was exfiltrated, and no lateral movement occurred. The user’s credentials were reset and all active sessions were ended as a precaution. Security teams are advised to block outbound SMB traffic on port 445 and consider disabling the WebClient service on workstations that do not need WebDAV. Monitoring DNS queries to blockchain RPC domains from browser processes is strongly recommended. Searching the Windows Run dialog history for rundll32 or UNC path entries can also help surface early signs of compromise. Indicators of Compromise (IoCs):- Type Indicator Description Domain autum-path[.]vo8xalon[.]in[.]net GULoader C2 domain used in the UNC path command IPv4 Address 188[.]114[.]96[.]7 Cloudflare reverse proxy resolving the GULoader C2 domain IPv4 Address 188[.]114[.]97[.]7 Cloudflare reverse proxy resolving the GULoader C2 domain Domain bsc-testnet[.]drpc[.]org BNB Smart Chain Testnet RPC endpoint used for EtherHiding payload retrieval Domain data-seed-prebsc-1-s1[.]bnbchain[.]org Fallback BSC node contacted on port 8545 File Path \autum-path[.]vo8xalon[.]in[.]net\05fe317c-0981-4de2-bc8a-930d369db441\ck-3d Remote UNC path pasted and executed via Windows Run dialog SHA-256 172a25a9ed8b798d8baeec29424b46627b5b39723b37c787f928d3700509001e Hash of the malicious file associated with the campaign MD5 236e1bef618edfe7f7c29ee2b4cba620 MD5 hash of the malicious file associated with the campaign Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM. Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google. Tags cyber security cyber security news Copy URL Linkedin Twitter ReddIt Telegram Tushar Subhra Dutta Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics. Trending News BugHunter – Bug Bounty Toolkit Powered by Claude and Free AI Providers CISA Warns of Google Chromium 0-Day Vulnerability Exploited in Attacks Critical Wazuh Vulnerability Lets Attackers Tamper with Alerts and Delete Security Evidence Hackers Abuse Residential Proxy Networks to Hide Malicious Activity and Evade Detection China-Nexus Hackers Use Backdoored PAM Modules for Credential Theft and Authentication Bypass Latest News ANY.RUN The Half-Life of Threat Intelligence: When Does an IOC Stop Being Useful?  Cyber Security News Critical Fortinet FortiSandbox Vulnerabilities Actively Exploited in Attacks Press Release Aembit Extends IAM for Agentic AI to Microsoft Copilot Studio Cyber Security India Temporarily Bans Telegram Messenger Over Medical Exam Fraud Cyber Security News Microsoft 365 Device Code Phishing Campaign Bypasses Password Theft With Legitimate Login Flow