ClickFix Intrusion Used EtherHiding, Potemkin Loader, and EtherRAT for Domain-Wide Compromise

Attackers turned a single ClickFix social-engineering lure into a multi-stage Windows intrusion that abused pcalua.exe to launch mshta.exe, retrieve an HTA payload, and install malware that progressed through loaders and remote-access tooling. Reporting describes a chain involving EtherHiding infrastructure and GULoader, while Huntress documented a related intrusion in which an MSI dropped Potemkin, a custom x64 loader that used a deterministic 10,000-domain DGA to find command-and-control servers and reflectively load a follow-on DLL called RMMProject entirely in memory. RMMProject provided browser credential and cookie theft, a Chrome App-Bound Encryption bypass via helper DLL injection, hidden-desktop remote control, process injection, screenshot capture, and runtime module loading.

The operators then established persistence with Run keys, scheduled tasks, and a renamed Cloudflare Tunnel, and deployed EtherRAT, a Node.js backdoor that resolved its C2 from an Ethereum smart contract. Huntress said the attackers conducted hands-on-keyboard activity, repeatedly battled Microsoft Defender, attempted to deploy Chisel reverse SOCKS tunnels, and used WinRM, WMIExec, and SMBExec for lateral movement, spreading EtherRAT to more than 11 hosts including the domain controller. The intrusion showed how an unmonitored initial endpoint allowed hours of attacker activity before defenders had telemetry, enabling a single user action to escalate into a network-wide compromise.