A new cyberattack campaign is targeting Windows users through fake CAPTCHA pages, combining three techniques to slip past standard security defenses without raising alarms.

The campaign, first observed in April 2026, begins on a compromised European small-business website and ends with an attempt to load GULoader, a memory-based malware downloader, onto a victim’s machine.

What makes this attack dangerous is how naturally it blends into normal browsing, deceiving both users and automated security tools.

The attack targets users who arrive at a legitimate-looking website through a Google search, with no phishing email or suspicious link involved.

The website functions exactly as expected, with product pages, contact forms, and maps all working normally. Malicious code hidden in the site’s WordPress backend quietly waits to activate under the right conditions.

Analysts at Sicuranext identified this intrusion and documented the full attack path. According to Sicuranext report shared with Cyber Security News (CSN), the campaign chains a compromised WordPress site, a blockchain-based payload method called EtherHiding, a social engineering trick called ClickFix, and a remote loader attributed to GULoader.

Kill chain (Source - Sicuranext) — Kill chain (Source – Sicuranext)

Every layer is built to appear legitimate, giving most traditional defenses no reason to intervene. The infected site targets only desktop Windows browsers.

Anyone visiting from a phone or a security scanner sees a perfectly clean page, hiding the attack from site owners, search engines, and automated monitors.

Only a real Windows user at a desktop triggers the payload, making this campaign very hard to detect through routine checks.

In this specific incident, behavioral detection stopped the attack in under 300 milliseconds before GULoader could load. The campaign still came dangerously close to succeeding and exposed real gaps in how organizations defend against this type of threat.

ClickFix Campaign Uses EtherHiding and GULoader

The attack begins the moment the victim lands on the compromised page. Within two seconds, injected JavaScript silently contacts the BNB Smart Chain Testnet, a free public blockchain, to fetch a malicious payload stored in a smart contract.

This technique, known as EtherHiding, is hard to block because requests travel through trusted providers like Cloudflare, and blockchain data cannot be removed through abuse reports.

Social engineering via fake CAPTCHA (Source - Sicuranext) — Social engineering via fake CAPTCHA (Source – Sicuranext)

Once retrieved, the payload displays a fake reCAPTCHA overlay on the legitimate page. The overlay tells the user to press Win+R, Ctrl+V, and Enter, shortcuts that open the Windows Run dialog and paste a command.

Unknown to the user, the clipboard was already loaded with a malicious instruction via a built-in browser function, and the victim runs it willingly, believing it to be a routine check.

The command calls rundll32.exe, a trusted signed Windows tool, pointing it to a remote DLL hosted by the attacker over a UNC path. Because rundll32.exe is a Microsoft-signed binary, it clears SmartScreen without any warning.

The DLL loads directly into memory with no file written to disk and no prompt shown, bypassing antivirus tools that scan files before execution.

GULoader Delivery and Behavioral Detection

The C2 domain in this campaign, autum-path[.]vo8xalon[.]in[.]net, is attributed to GULoader based on threat intelligence reporting.

GULoader is a shellcode-based loader running entirely in memory, commonly used to drop infostealers like Lumma and Vidar and remote access tools such as Remcos and AgentTesla. A successful execution could have led to credential theft or full remote control of the victim’s machine.

A behavioral rule targeting rundll32.exe with unusual arguments and ordinal-based function calls flagged and killed the process within 300 milliseconds.

Post-incident checks confirmed no child processes were spawned, no data was exfiltrated, and no lateral movement occurred. The user’s credentials were reset and all active sessions were ended as a precaution.

Security teams are advised to block outbound SMB traffic on port 445 and consider disabling the WebClient service on workstations that do not need WebDAV.

Monitoring DNS queries to blockchain RPC domains from browser processes is strongly recommended. Searching the Windows Run dialog history for rundll32 or UNC path entries can also help surface early signs of compromise.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Domain	autum-path[.]vo8xalon[.]in[.]net	GULoader C2 domain used in the UNC path command
IPv4 Address	188[.]114[.]96[.]7	Cloudflare reverse proxy resolving the GULoader C2 domain
IPv4 Address	188[.]114[.]97[.]7	Cloudflare reverse proxy resolving the GULoader C2 domain
Domain	bsc-testnet[.]drpc[.]org	BNB Smart Chain Testnet RPC endpoint used for EtherHiding payload retrieval
Domain	data-seed-prebsc-1-s1[.]bnbchain[.]org	Fallback BSC node contacted on port 8545
File Path	\autum-path[.]vo8xalon[.]in[.]net\05fe317c-0981-4de2-bc8a-930d369db441\ck-3d	Remote UNC path pasted and executed via Windows Run dialog
SHA-256	172a25a9ed8b798d8baeec29424b46627b5b39723b37c787f928d3700509001e	Hash of the malicious file associated with the campaign
MD5	236e1bef618edfe7f7c29ee2b4cba620	MD5 hash of the malicious file associated with the campaign

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post ClickFix Campaign Uses EtherHiding and GULoader to Infect Windows Users via Fake CAPTCHA appeared first on Cyber Security News.