OCRFix Botnet Trojan Leveraging ClickFix Phishing and EtherHiding to Conceal Blockchain-Based Command Infrastructure
A botnet trojan campaign, named OCRFix, has been detected leveraging social engineering techniques and blockchain-based command infrastructure to establish a network of compromised systems.
A botnet trojan campaign, named OCRFix, has been detected leveraging social engineering techniques and blockchain-based command infrastructure to establish a network of compromised systems.
Phishing Techniques and Infrastructure
The OCRFix campaign employs ClickFix phishing tactics combined with EtherHiding, a method that conceals attacker commands on a public blockchain, complicating takedown efforts.
The attack initiates with a typosquatting site mimicking tesseract-ocr[.]com, a deceptive clone of the authentic Tesseract OCR tool. The legitimate Tesseract project is hosted on GitHub, which lacks a dedicated website, making it susceptible to domain impersonation.
In addition to traditional SEO poisoning , the campaign also uses LLM poisoning, wherein the ChatGPT chatbot inadvertently recommends the malicious site.
The campaign was analyzed by Cyjax analysts during routine threat monitoring, wherein the phishing site presented visitors with a counterfeit CAPTCHA prompt.
The attack initiates with a typosquatting site mimicking tesseract-ocr[.]com, a deceptive clone of the authentic Tesseract OCR tool.
Upon clicking to "verify," a heavily obfuscated PowerShell command was copied to the user's clipboard. Users were instructed to execute the command in Windows PowerShell, which subsequently decoded itself to connect to a server at opsecdefcloud[.]com, initiating the download of a malicious MSI file, 98166e51.msi, to start the infection chain. Post-attack, victims were redirected to the legitimate Tesseract GitHub page.
Update1.exe: Acts as a loader, querying a BNB TestNet smart contract for the C2 address and downloading a data.zip package from attacker-controlled servers. Setup_helper.exe: Ensures persistence by creating a scheduled task to execute the final payload every minute and adding exclusion paths to evade Windows Defender . CfgHelper.exe: Functions as the bot listener, transmitting the victim's IP address, OS name, device name, and unique identifiers to the bot control panel at ldture[.]com.
EtherHiding: Command Channel via Blockchain
OCRFix uniquely employs EtherHiding, embedding C2 addresses within smart contracts on the BNB Smart Chain TestNet, circumventing traditional server-based blocking by security teams. Three contract addresses were identified during analysis.
The malware stages query the public blockchain node bsc-testnet.publicnode[.]com for the stored URL, allowing attackers to update the C2 address by altering the contract's stored variable. This technique, previously associated with North Korean threat groups, indicates growing adoption among other cybercriminal entities.
Organizations should restrict PowerShell execution, enabling script block logging to detect obfuscated commands. Security awareness training should address ClickFix-style fake CAPTCHA prompts, emphasizing that legitimate sites will not request users to paste PowerShell commands .
Endpoint tools should flag unusual WMI queries and the creation of unexpected high-privilege scheduled tasks. Network teams should monitor connections to public blockchain nodes, which generally lack legitimate business purposes in most environments.
Based on reporting by Cyber Security News.