Executive Summary
Researchers from Lab539 on 12 August 2026 observed a widespread campaign utilizing compromised WordPress sites to deliver a ClickFix verification flow that prompts users to execute a malicious PowerShell command. The injected JavaScript employs an EtherHiding mechanism, retrieving AES-encrypted code from an Ethereum smart contract on the Sepolia network rather than hardcoding the payload directly on the compromised site.
The PowerShell stage uses randomized subdomains to download a Remote Access Trojan (RAT), disguised as an Inno Setup package containing an embedded Python 3.11 environment, from a Cloudflare R2 bucket.
This Python RAT queries a separate Ethereum mainnet contract to locate its command-and-control server and subsequently communicates via a custom DNS-shaped protocol designed to mimic legitimate Microsoft traffic. The attacker, further investigated in a second Lab539 report, gains reputation from legitimate compromised websites, configuration agility from Ethereum, disposable web infrastructure through randomized hostnames, and inexpensive malware distribution through object storage.
Multiple EMEA RH-ISAC Core Members are currently investigating this campaign and are currently monitoring the situation for additional updates.
Key Takeaways
- The initial compromise injects heavily obfuscated JavaScript into the HTML of legitimate WordPress sites, presenting a familiar ClickFix-style verification flow to persuade the user to execute a PowerShell command.
- The injected JavaScript acts as an EtherHiding loader, performing an Ethereum JSON-RPC eth_call against the Sepolia network to retrieve encrypted code, which it then decrypts, caches, and executes dynamically in the browser.
- The executed PowerShell command initiates a multi-stage process that uses randomized subdomains and ultimately downloads IntelSoftwareUpdaterV8.exe, a Python-based RAT wrapped in an Inno Setup package, from a Cloudflare R2 public bucket.
- The RAT establishes persistence via a hidden scheduled task and utilizes a second EtherHiding layer by querying an Ethereum mainnet contract to resolve its command-and-control server IP address.
- The Ethereum contract allows the operator to set both global C2 configurations and victim-specific infrastructure, which is useful for segregating high-value targets or testing environments.
- The RAT communicates with the C2 server using a custom UDP/53 protocol that formats packets to look like ordinary Microsoft-related DNS activity, but sends them directly to an attacker-controlled server instead of the system’s configured recursive DNS resolver.
Indicators of Compromise
Lab539 has provided indicators of compromise associated with the compromised WordPress campaign:
Web delivery
karburatorotzhigi[.]com
*.karburatorotzhigi[.]com
pub-b7e3d7ad9f6e4b08a24cde45feeb417e.r2[.]dev
IntelSoftwareUpdaterV8.exe
SHA256: d4ec082b2b2112796bc5dc94835cad9536762da738ba3a2af638efa6d2f76b49
The PowerShell chain and R2 location were directly recovered from the compromised-site delivery infrastructure.
Browser EtherHiding
Sepolia contract:
0x0321C73150543FAa9D016c9c46Abf293Eb6839e4
Function selector:
3bc5de30
Malware EtherHiding
Ethereum mainnet contract:
0x5d04ed162c548fc4508cbb59266b02afbaf3ebc1
C2:
91.92.240[.]100:53/UDP
Wallets
Known contract deployer:
0x820f3b366bb5cb03ad25f7190c16acf152bdbb82
Infrastructure funding wallet:
0x62da4cc20f1ef83e853a17439e00738dbf1d8e14
Sibling deployment wallet:
0xb9170160532c700f8d948aa9835ff060e58bde56
Host artifacts
Scheduled task:
IntelSoftwareUpdater
Directory:
%LOCALAPPDATA%\Microsoft\WindowsApps\
Microsoft[.]PythonApp_code$GetMachineHash\
