A compromised WordPress website used a traffic filtering system and blockchain-hosted payload delivery to push a ClickFix lure at Windows visitors, leading to an attempted GULoader infection that was stopped by endpoint protection in less than 300300 milliseconds.
The intrusion was confirmed through two sources: an ANY.RUN sandbox detonation of the infected site and real endpoint telemetry from a corporate Windows system.
Together, they exposed the full attack chain, from the user opening a legitimate small-business website to a blocked rundll32.exe execution tied to GULoader delivery.
The abused website was not a fake domain or phishing page. It was a real, small-business WordPress and WooCommerce site that appears to have been compromised by an ErrTraffic-style backdoor.
Researchers found that the attackers preserved the site’s normal content, including product pages, contact forms, maps, and analytics, while silently injecting malicious JavaScript into public pages.
WordPress Site Spreads GULoader
The JavaScript worked in two stages. First, it collected visitor details, including browser type, operating system, screen size, referrer, and IP-related metadata.
That information was sent to attacker-controlled infrastructure used as a Traffic Direction System, or TDS. The TDS then decided whether the visitor should receive the next-stage payload.
This filtering mattered. The malicious content was reportedly shown only to desktop Windows users.
Mobile visitors, search crawlers, and many analysis tools would likely see a clean version of the site. That made the compromise harder to detect and helped the attackers avoid broad exposure.
About 2 seconds after page load, the injected script connected to the BNB Smart Chain Testnet via public RPC infrastructure.
This is part of the EtherHiding technique, in which attackers store malicious code in blockchain smart contracts rather than on a traditional server.
Because blockchain data is public, resilient, and difficult to remove, it gives threat actors a stealthy delivery layer.
Telemetry showed requests to bsc−testnet[.]drpc[.]orgbsc−testnet[.]drpc[.]org and a fallback node at data−seed−prebsc−1−s1[.]bnbchain[.]orgdata−seed−prebsc−1−s1[.]bnbchain[.]org.
In the sandbox, Suricata flagged the activity as EtherHiding-related. On the endpoint, DNS and network records confirmed the same chain. Researchers also observed Yandex Metrika traffic, suggesting the operators tracked victim interaction.
After retrieving the payload, the site displayed a fake reCAPTCHA-style prompt. This was the ClickFix step.
The page instructed the victim to press Win+RR, paste a command, and hit Enter. At the same time, malicious JavaScript had already placed the command into the clipboard, sicuranext said.
The victim later confirmed they followed those steps, believing the prompt was a standard CAPTCHA.
The pasted command launched rundll32.exerundll32.exe with a remote UNC path and an ordinal-based export call. This technique is designed to blend into trusted Windows behavior.
Since rundll32.exerundll32.exe is a signed Microsoft binary, it often passes reputation and allow-list checks. The remote path also avoided writing a payload to disk, reducing the chance of file-based antivirus detection.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
