ClickFix Campaign Delivers SectopRAT via EtherHiding & BYOI Python

Vega Threat Research uncovered a large-scale ClearFake / ClickFix campaign compromising over 2,000 WordPress sites. The operation uses a multi-stage infection chain and appears to function as a multi-tenant traffic distribution system, where initial access and victim filtering are handled upstream, and final payload delivery is controlled by downstream actors. Notably, the campaign leverages “EtherHiding”-style techniques, retrieving parts of its delivery logic from blockchain-based infrastructure to make takedown and analysis more difficult.

The attack begins in the browser with injected scripts that profile the victim’s environment and selectively deliver a fake verification prompt to targeted users. This often takes the form of a spoofed reCAPTCHA challenge, adding legitimacy to the lure and increasing the likelihood of user interaction. Victims are then tricked into executing a command on their own system, effectively bypassing traditional browser-based protections.

Once executed, the infection chain leverages trusted, signed binaries to run malicious scripts under legitimate-looking processes. These scripts download and execute additional payloads while evading common security controls and establishing persistence on the system.

In its final stage, the campaign deploys Python-based malware components, including a full-featured information stealer and a secondary lightweight implant. The malware operates largely in memory and uses legitimate infrastructure to blend in with normal activity.

The stealer targets a wide range of sensitive data, including browser-stored credentials, session cookies, financial information, cryptocurrency wallets, messaging apps, and various desktop applications. It also supports surveillance capabilities and system reconnaissance, enabling continued access and further exploitation.