Back Cybersecuritynews

OCRFix Botnet Trojan Leveraging ClickFix Phishing and EtherHiding to Conceal Blockchain

Cybersecuritynews •Tushar Subhra Dutta • March 2, 2026

A newly identified botnet trojan campaign, dubbed OCRFix, has been discovered combining social engineering tricks with blockchain-based command infrastructure to quietly build a network of compromised machines. The campaign blends the well-known ClickFix phishing technique with EtherHiding — a method that stores attacker instructions directly on a public blockchain, making takedowns nearly impossible. The attack […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OCRFix Botnet Trojan Combines ClickFix Phishing with EtherHiding Tactics The OCRFix botnet trojan campaign has been identified, utilizing ClickFix phishing techniques alongside EtherHiding to establish a resilient network of compromised machines. This method embeds attacker commands directly onto a public blockchain, complicating efforts for takedowns and detection. 3 sources 49

Extracted Entities

OCRFix Botnet Trojan Leveraging ClickFix Phishing and EtherHiding to Conceal Blockchain

The full story

Extracted Entities

Attack Types (3)

Malware (1)

MITRE ATT&CK (1)