OCRFix Botnet Trojan Leveraging ClickFix Phishing and EtherHiding to Conceal Blockchain ...

Back Cybersecuritynews

OCRFix Botnet Trojan Leveraging ClickFix Phishing and EtherHiding to Conceal Blockchain ...

Cybersecuritynews • March 2, 2026

Share: View original

OCRFix botnet uses ClickFix lures and blockchain-based EtherHiding C2 via fake Tesseract OCR sites to infect systems.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OCRFix Botnet Trojan Combines ClickFix Phishing with EtherHiding Tactics The OCRFix botnet trojan campaign has been identified, utilizing ClickFix phishing techniques alongside EtherHiding to establish a resilient network of compromised machines. This method embeds attacker commands directly onto a public blockchain, complicating efforts for takedowns and detection. 3 sources 49

Extracted Entities

Attack Types (4)

Botnet Malware Phishing Trojan

Malware (2)

ClickFix OCRFix

MITRE ATT&CK (2)

T1071.001 - Web Protocols T1566 - Phishing

Tools (1)