Back Gbhackers

OCRFix Botnet Uses ClickFix Phishing and EtherHiding to Mask Blockchain C2 Infrastructure

Gbhackers •Mayura Kathir • March 2, 2026

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OCRFix Botnet Trojan Combines ClickFix Phishing with EtherHiding Tactics The OCRFix botnet trojan campaign has been identified, utilizing ClickFix phishing techniques alongside EtherHiding to establish a resilient network of compromised machines. This method embeds attacker commands directly onto a public blockchain, complicating efforts for takedowns and detection. 3 sources 49

Extracted Entities

OCRFix Botnet Uses ClickFix Phishing and EtherHiding to Mask Blockchain C2 Infrastructure

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)