ClickFix Meets EtherHiding: 5,400+ Compromised Sites Serving Malicious Code from the BNB Smart Chain — Detection and Defense Guide

---
title: ClickFix Execution - Mshta or PowerShell Spawned by Run Dialog
description: Detects mshta.exe, powershell.exe, or curl.exe launched as a direct child of explorer.exe, consistent with a user pasting a malicious command into the Windows Run dialog per ClickFix social-engineering lures delivered via compromised websites.
author: Security Arsenal
id: 3b9f2e71-6c4a-4d8e-b1f7-9a2c5e8d4f01
status: experimental
references:
  - https://www.bleepingcomputer.com/news/security/over-5-400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain/
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1218/005/
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wscript.exe'
  selection_cmd:
    CommandLine|contains:
      - 'http'
      - '-enc'
      - '-e '
      - 'hidden'
      - 'iex'
      - 'downloadstring'
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - Rare legitimate administrative one-liners run via Win+R; review CommandLine content
level: high
---
title: EtherHiding Staging - Browser Process Connecting to BNB Smart Chain RPC Endpoints
description: Detects web browsers initiating network connections to public BNB Smart Chain RPC endpoints, consistent with EtherHiding payload retrieval where malicious JavaScript on compromised sites reads attacker-controlled smart contract data via eth_call.
author: Security Arsenal
id: 7d4a1c93-2f8b-4e6a-a3d5-5c1b9e7f3a22
status: experimental
references:
  - https://www.bleepingcomputer.com/news/security/over-5-400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain/
  - https://attack.mitre.org/techniques/T1102/
date: 2026/02/10
tags:
  - attack.command_and_control
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  selection_dst:
    DestinationHostname|contains:
      - 'bsc-dataseed'
      - 'binance.org'
      - 'bscrpc.com'
      - 'rpc.ankr.com'
      - 'bsc.publicnode.com'
      - 'binance-smart-chain'
  condition: selection_image and selection_dst
falsepositives:
  - Cryptocurrency users and Web3 developers browsing legitimate BSC dApps; baseline per user role and investigate in context of preceding ClickFix process activity
level: medium
---
title: ClickFix RunMRU Artifact - Suspicious Command Entered in Run Dialog
description: Detects suspicious values written to the Windows RunMRU registry key, which records commands users type into the Win+R dialog. ClickFix victims paste attacker commands here, leaving a durable forensic artifact even if the process fails.
author: Security Arsenal
id: e1c8f5a4-9b3d-4a7c-8e2f-6d0a4b9c1e73
status: experimental
references:
  - https://www.bleepingcomputer.com/news/security/over-5-400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain/
  - https://attack.mitre.org/techniques/T1204/002/
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains: 'Explorer\RunMRU'
  selection_value:
    Details|contains:
      - 'mshta'
      - 'powershell'
      - 'curl '
      - 'wscript'
      - 'iex'
      - 'http://'
      - 'https://'
  condition: selection_key and selection_value
falsepositives:
  - IT staff running remote script URLs via Run dialog (uncommon and itself worth reviewing)
level: high

// Hunt 1: ClickFix execution pattern - LOLBins spawned by explorer.exe with web/download commands
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("mshta.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wscript.exe")
| where ProcessCommandLine has_any ("http", "-enc", "hidden", "iex", "downloadstring", "invoke-")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, ReportId
| order by TimeGenerated desc;

// Hunt 2: EtherHiding staging - browser connections to BNB Smart Chain public RPC endpoints
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe")
| where RemoteUrl has_any ("bsc-dataseed", "bscrpc.com", "rpc.ankr.com", "bsc.publicnode.com")
   or RemoteUrl endswith "binance.org"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| order by TimeGenerated desc;

// Hunt 3: Correlate staging to execution - same device hits BSC RPC then spawns suspicious child of explorer
let RpcHits = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
| where RemoteUrl has_any ("bsc-dataseed", "bscrpc.com", "rpc.ankr.com")
| summarize FirstRpc = min(TimeGenerated) by DeviceName;
RpcHits
| join kind=inner (
    DeviceProcessEvents
    | where InitiatingProcessFileName =~ "explorer.exe"
    | where FileName in~ ("mshta.exe", "powershell.exe", "curl.exe")
    | where ProcessCommandLine has_any ("http", "iex", "-enc", "hidden")
) on DeviceName
| where TimeGenerated between (FirstRpc .. FirstRpc + 30m)
| project DeviceName, FirstRpc, ExecutionTime = TimeGenerated, FileName, ProcessCommandLine, AccountName;

-- ClickFix hunt: RunMRU forensic artifact + explorer-spawned LOLBins + BSC RPC connections
-- RunMRU retains the exact pasted command even if execution was blocked by EDR

LET runmru = SELECT
    Key.FullPath AS RunMRUKey,
    Key.Name AS Entry,
    Key.Data.value AS PastedCommand,
    Key.Mtime AS Modified
FROM read_reg_key(
    globs='HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\*',
    accessor='registry'
)
WHERE PastedCommand =~ 'mshta|powershell|curl|wscript|iex|http'

LET clickfix_procs = SELECT
    Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)mshta|powershell|pwsh|curl|wscript'
  AND CommandLine =~ '(?i)http|iex|-enc|hidden|downloadstring'

LET bsc_net = SELECT
    Pid, Name, Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)chrome|msedge|firefox'
  AND Status =~ 'ESTAB'

SELECT * FROM runmru
UNION ALL
SELECT * FROM clickfix_procs

# ClickFix + EtherHiding Defense: audit RunMRU artifacts, restrict mshta, and alert on BSC RPC egress
# Run elevated. Review output before applying blocks in production.

# 1) Forensic sweep: export suspicious RunMRU entries for all loaded user hives
$runMruPath = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
if (Test-Path $runMruPath) {
    $props = Get-ItemProperty -Path $runMruPath
    $props.PSObject.Properties | Where-Object {
        $_.Name -match '^[a-z]$' -and $_.Value -match 'mshta|powershell|curl|wscript|iex|http'
    } | ForEach-Object {
        Write-Warning "Suspicious RunMRU entry: $($_.Value)"
    }
}

# 2) Block outbound HTTPS from browsers to known BSC public RPC endpoints (defense-in-depth; prefer proxy/SWG enforcement)
$bscRpcHosts = @('bsc-dataseed.binance.org','bsc-dataseed1.defibit.io','bscrpc.com','bsc.publicnode.com')
foreach ($h in $bscRpcHosts) {
    $ips = (Resolve-DnsName $h -Type A -ErrorAction SilentlyContinue).IPAddress
    foreach ($ip in $ips) {
        New-NetFirewallRule -DisplayName "Block BSC RPC - $h" -Direction Outbound `
            -RemoteAddress $ip -Protocol TCP -RemotePort 443 -Action Block -ErrorAction SilentlyContinue
    }
}

# 3) Constrain mshta abuse via Windows Defender Application Control / AppLocker (example deny for standard users)
# Prefer AppLocker policy over deletion: create a DENY rule on %SystemRoot%\System32\mshta.exe for non-admin groups.

# 4) Audit current explorer-spawned LOLBin executions on this host (last 24h)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'explorer.exe' -and $_.Message -match 'mshta|powershell|curl' -and $_.Message -match 'http' } |
    Select-Object TimeCreated, Message | Format-List