A newly identified botnet trojan campaign, dubbed OCRFix, has been discovered combining social engineering tricks with blockchain-based command infrastructure to quietly build a network of compromised machines.

The campaign blends the well-known ClickFix phishing technique with EtherHiding — a method that stores attacker instructions directly on a public blockchain, making takedowns nearly impossible.

The attack starts with a typosquatting website impersonating tesseract-ocr[.]com, a convincing fake of the legitimate open-source Optical Character Recognition tool, Tesseract OCR.

Since the real Tesseract project is hosted on GitHub and lacks its own website, it made an easy target for domain impersonation.

Alongside traditional SEO poisoning, the campaign also employed LLM poisoning, where the chatbot ChatGPT was observed actively recommending the malicious site to unsuspecting users.

A YouTube video found during the investigation also appeared to push these fraudulent instructions.

Cyjax analysts, who first identified the campaign during routine threat monitoring, observed that the phishing site greeted visitors with a fake CAPTCHA prompt.

Example of the fake CAPTCHA (Source - Cyjax) — Example of the fake CAPTCHA (Source – Cyjax)

Once a user clicked to “verify,” a heavily obfuscated PowerShell command was silently copied to their clipboard.

The page then told the user to open Windows PowerShell and paste it, presenting this as a normal verification step.

In reality, the command decoded itself and connected to a server at opsecdefcloud[.]com, downloading a malicious MSI file (98166e51.msi) that started the infection chain.

After the attack, victims were quietly redirected to the real Tesseract GitHub page, so everything appeared normal.

Once the MSI file ran, the malware deployed in three stages. The first, Update1.exe, acted as a loader — it queried a BNB TestNet smart contract for the C2 address, then downloaded and unpacked a data.zip package from attacker-controlled servers.

The second stage, setup_helper.exe, handled persistence by creating a scheduled task that ran the final payload every minute at the highest privilege level, while also adding exclusion paths to bypass Windows Defender.

Scheduled task command used for persistence (Source - Cyjax) — Scheduled task command used for persistence (Source – Cyjax)

The third stage, CfgHelper.exe, was the bot listener — it gathered the victim’s IP address, OS name, device name, and unique identifiers, then sent this data to the bot control panel at ldture[.]com.

Rendered 'Bot Control Panel' (Source - Cyjax) — Rendered ‘Bot Control Panel’ (Source – Cyjax)

Cyrillic comments in the panel’s source code suggest the operators may be Russian, though this remains unconfirmed.

Full attack flow (Source - Cyjax) — Full attack flow (Source – Cyjax)

The campaign is carefully built to keep victims unaware of the compromise for as long as possible.

The combination of fake legitimacy, clipboard injection, and a layered malware chain makes OCRFix a strong example of how straightforward phishing tricks can be used to support a hard-to-detect and lasting intrusion.

EtherHiding: Blockchain as a Command Channel

The most technically distinct part of OCRFix is its use of EtherHiding to store command and control (C2) addresses.

Instead of pointing malware at a traditional server that security teams can block, the attackers embedded their C2 URLs inside smart contracts on the BNB Smart Chain TestNet.

Three separate contract addresses were identified during analysis.

Transactions found within BNB TestNet (Source - Cyjax) — Transactions found within BNB TestNet (Source – Cyjax)

When each malware stage needed its next instruction, it queried the public blockchain node bsc-testnet.publicnode[.]com to retrieve the stored URL.

Since the blockchain itself cannot be taken down, the attacker can update the C2 address at any time by modifying the contract’s stored variable.

This technique has previously been linked to North Korean threat actors, and its appearance here signals broader adoption across other groups.

Organizations should restrict PowerShell execution to only those who need it, with script block logging enabled to detect obfuscated commands.

Security awareness training should address ClickFix-style fake CAPTCHA prompts, so staff understand that no legitimate site will ask them to paste PowerShell commands.

Endpoint tools should flag unusual WMI queries and unexpected high-privilege scheduled task creation. Network teams should monitor for outbound connections to public blockchain nodes, which have no legitimate business purpose in most environments.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post OCRFix Botnet Trojan Leveraging ClickFix Phishing and EtherHiding to Conceal Blockchain-Based Command Infrastructure appeared first on Cyber Security News.