John Fitzpatrick From Ethereum to DNS C2: Reverse Engineering the ClickFix Payload Inside the ClickFix payload: how DeviceManager uses Ethereum to locate its C2, communicate over DNS and maintain persistent access. C2 ClickFix EtherHiding Malware
John Fitzpatrick From Compromised WordPress Sites to Blockchain-Backed Malware A technical look at a ClickFix campaign using compromised WordPress sites, Ethereum-backed JavaScript, PowerShell and Cloudflare R2 to deliver malware. ClickFix EtherHiding
