OCRFix Botnet Uses ClickFix Phishing and EtherHiding to Mask Blockchain C2 Infrastructure

OCRFix is a multi-stage botnet Trojan campaign that abuses a fake Tesseract OCR download site, ClickFix-style PowerShell execution, and EtherHiding on BNB Smart Chain to conceal a rotating blockchain-backed command infrastructure.

The fake site gates content behind a bogus CAPTCHA and then instructs users to open PowerShell and paste a pre-copied command, a hallmark of ClickFix campaigns where user interaction is abused to “self‑approve” execution of malicious scripts.

The PowerShell command contains heavy decimal-encoded data and XOR-based string reconstruction that ultimately instantiates a Net.WebClient object to pull an MSI installer from opsecdefcloud[.]com, dropping the first-stage payload in the chain.

Threat hunters at CYJAX identified a typosquatting domain mimicking Tesseract OCR, a popular open-source OCR engine distributed via GitHub rather than an official vendor website, making it an attractive target for domain impersonation and SEO abuse.

Users were then instructed to open Windows PowerShell and paste a command into it to become verified.

After execution, victims are redirected to legitimate Tesseract documentation and GitHub content, helping preserve trust and encouraging positive user mentions that further boost the phishing site’s search reputation.

OCRFix Botnet

A standout aspect of OCRFix is its use of EtherHiding, where C2 information is stored within smart contracts on public blockchains, rather than hardcoded into the binaries.

The operators leverage BNB Smart Chain TestNet contracts that embed key data in transaction input fields; the malware queries these contracts via a service such as PublicNode and parses the most recent transaction to recover stage-specific C2 URLs.cloud.

Further analysis of the site shows links to 12 social media accounts on platforms such as Facebook, Instagram, YouTube, Pinterest, Tumbler, Twitch, and DeviantArt.

This design mirrors earlier EtherHiding activity adopted by the DPRK-linked UNC5342 actor, which similarly used BNB and Ethereum contracts to host obfuscated payload locations and rotate infrastructure as entries are updated.

By externalising C2 addresses to a decentralized ledger and fronting access with common API endpoints, OCRFix significantly complicates static detection and allows rapid secretLink rotation when domains are blocked or sinkholed. radar.

The initial MSI drops a sequence of three executables, each paired with a same-named DLL that in practice contains compiled VBScript executed by a repurposed VbsEdit Script Launcher binary signed with an expired Adersoft certificate.

This unusual EXE–DLL pairing decouples the malicious VBScript from the launcher and may help evade simplistic binary reputation and signature checks that expect conventional PE DLL behavior.

Stage one (Update1.exe) acts as a loader, querying the first BNB TestNet contract for a C2 URL, then downloading an encrypted archive from dltruek[.]com and unpacking a second-stage executable into a local app_config directory with benign-looking install logs.

Stage two (setup_helper.exe) both establishes persistence via scheduled tasks and performs defence evasion, including disabling security features, adding Windows Defender exclusions, and repeatedly polling blockchain-derived C2 endpoints to fetch configuration archives containing the final payload.

The third stage (CfgHelper.exe) turns the host into a bot listener, resolving the bot server via another TestNet contract, then beacons every 60 seconds with system identifiers and IP data to a “checkin” endpoint on domains such as ldture[.]com.

ClickFix Phishing and EtherHiding

The primary C2 host also exposes a web-based bot management panel that appears to rely on front-end HTML/CSS to hide content rather than robust authentication, enabling analysts to inspect much of its structure client-side.

Comments in the HTML include Cyrillic text and multiple AI-like code artefacts, hinting at possible Russian-speaking operators and AI-assisted development, although no firm attribution to a known threat group is currently justified.

The panel tracks active bots, synchronised roughly every minute, and exposes a “Create Task” capability that allows operators to push additional payloads or scripts to selected hosts, including optional DLL-based tasks that could support further sideloading or tooling deployment.

Pivoting on infrastructure shows at least two additional domains oklefe[.]com and ldveriz[.]com hosting near-identical panels, suggesting either active redundancy or recycled infrastructure across related campaigns.

OCRFix demonstrates how relatively simple initial access techniques typosquatting and ClickFix social engineering can front a highly resilient, blockchain-backed botnet using multi-stage loaders and EtherHiding for C2 agility.

Organisations should combine user training on PowerShell misuse and CAPTCHA lures with strict script execution controls, PowerShell/network egress hardening, and monitoring for connections to blockchain API services used to query suspicious smart contracts.

IOCs

Type	IOC	Description
Domain	ldture.com	Bot control panel domain
Domain	dltruek.com	C2 domain
Domain	oklefe.com	Alternative bot control panel domain
Domain	ldveriz.com	Alternative bot control panel domain
Domain	dltucra.com	C2 domain
Domain	tesseract-ocr.com	Initial phishing page
Domain	opsecdefcloud.com	Hosting page for initial MSI file
Domain	bsc-testnet.publicnode.com	EtherHiding address
Domain	checkpointviewzen.com	Domain in PowerShell script
SHA1	507e814c39b200b05f596d9569675aeb6c25ab4a	Initial MSI file that drops first payload: 98166e51.msi
SHA1	af6bbae2933e65d632f4f4624315c00d205bf6f7	First payload DLL: Updater1.dll
SHA1	4496afeb004df243b656d620f76ffdceef00b345	VBSedit Launcher used to run malicious DLLs
SHA1	c519a422d68e8d93f2b98ecb3fa064398045535e	Secondary payload DLL: setup_helper.dll
SHA1	96f2c607aec4432ccc7b762f9927c91ee04fb0e3	Final malware payload DLL: CfgHelper.dll

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.