A compromised WordPress page walks a victim through EtherHiding and a ClickFix paste into a native MZER-polyglot loader, which pulls down and injects a CLR-hosted .NET infostealer that harvests browser credentials and ships them out over an AES-wrapped socket. This advisory documents each stage, what the payloads steal, and how to detect them.
What a defender needs in thirty seconds.
The Omegatech cluster (AS202412) is running a WordPress-lure campaign that delivers two cooperating native x86-64 payloads. Both carry the cluster's signature 4D 5A 45 52 (“MZER”) header — a polyglot that reads as a valid MZ image to lazy parsers while executing as a position-independent GetPC stub, letting the ClickFix PowerShell cradle run the raw blob directly in memory.
The first payload, my_enterprise, is a compact loader: it fingerprints the host token, enumerates processes, downloads the second stage over WinHTTP from 158.94.211.92, and injects it into svchost.exe. The second payload, my_sss, hosts the .NET runtime and reflectively loads a managed infostealer that harvests browser credentials, cookies and local files, captures the screen, then AES-encrypts and exfiltrates over a custom TCP socket to a /c0g1k2s3 gate. Two public sandboxes corroborate the behavior; the earlier low VirusTotal/Zenbox score reflects only the benign .eml carrier, not the payload.
Eight stages from a victim landing on a compromised page to credentials leaving the host. Stages 1–4 are drawn from prior WP-001 tracking of this cluster; stages 5–8 are established by direct analysis of the two payloads in this advisory.
Victim reaches a legitimate-but-compromised WordPress site. Injected script in the page silently initiates the next stage — no attachment, no obvious download.
The page issues a read-only eth_call to a Binance Smart Chain testnet contract over TLS/443. The contract's return data hides the next-stage instructions on-chain — resilient, un-takedownable hosting that blends into normal RPC traffic.
A fake “verify you are human” / fix-this-error panel instructs the user to press Win+R and paste a pre-loaded clipboard command. The human is the execution primitive — no exploit required.
The pasted command launches PowerShell (observed UA: bare powershell / WindowsPowerShell/5.1.19041.4046) which retrieves the stage-2 blob and hands it to the MZER stub for in-memory execution.
50 KB console PE with MZER header. Runs as PIC, checks its process token/integrity (OpenProcessToken, GetTokenInformation), walks the process list (CreateToolhelp32Snapshot), then fetches the next stage via WinHTTP.
The loader allocates and writes the downloaded stage into a remote process and runs it: VirtualAllocEx → WriteProcessMemory → CreateRemoteThread, targeting svchost.exe to blend with normal service activity.
270 KB PE that hosts the .NET runtime (mscoree!CLRCreateInstance) and reflectively loads a managed stealer via DefineDynamicAssembly / DefinePInvokeMethod — building its P/Invoke stubs at runtime so there is no static import table to key on. It harvests browser secrets and local files and captures the screen.
Collected data is AES-encrypted (AesManaged / CryptoStream) and streamed over a raw TCP socket to the /c0g1k2s3 gate. Persistence via Task Scheduler COM / Windows service (per cluster tradecraft).
Two cooperating binaries, one delivery skin.
enterprise/my_sss.bin from 158.94.211.92./c0g1k2s3.Capability observed statically, corroborated by runtime detonation. The precise browser target list lives in an encrypted .rdata blob (entropy 7.34, runtime-keyed), so the categories below are stated at the confidence the evidence supports — not invented specifics.
CopyFromScreen / CopyPixelOperation (T1113).GetFiles, FindFirstFileExW, FileInfo.GetProcesses, get_UserDomainName, get_MainModule.DownloadString pulls additional instructions.Detonation traces (VirusTotal Jujubox) for both payloads. The decisive finding: neither sample completed its network stage under analysis — the low public sandbox scores reflect gated execution, not benign code.
Global\CLR_CASOFF_MUTEX and the IL\<hex>\<hex>\… registry keys are legitimate .NET CLR / Fusion artifacts created by any managed process. They look like campaign markers and are not — signaturing them would false-positive on benign .NET software.158.94.211.92 is new to this cluster's infrastructure set and is a clean AbuseIPDB candidate (categories 20 · 15). Earlier-stage infra (178.16.53.137, 91.92.243.161:3038) is tracked under WP-001.
| Type | Indicator | Context |
|---|---|---|
| SHA-256 | 1e0a8824261e3edb36d12fd5ce659cbb3989d4470809d2310cc56cd47da53555 | my_enterprise (loader) |
| SHA-256 | 41d8d77a24d3dc8d678423a5a4e69616cf60893f02ac8117e688970b1ff9e26e | my_sss (infostealer) |
| SHA-256 | 0f7a070dd42966ee67eeaa2dddf273749161c829f9d0a7d5fab40b4499f87f41 | my_sss recompile (detonated build) |
| SHA-256 | ce02b462fc089eb8b57e49287449630f2da4d9a78405e2e1b01d529682659d2a | .eml delivery carrier |
| MD5 | a1f7fc14f95158153c1fc1c5dc079af1 | my_enterprise |
| MD5 | d4b928f715e9636db9c571b64999353e | my_sss |
| IPv4 | 158.94.211.92 | Stage host + C2 · new |
| URL | http://158.94.211.92/enterprise/my_sss.bin | Stage-3 fetch |
| URI | /c0g1k2s3 | C2 exfil gate |
| HEADER | 4D 5A 45 52 E8 00 00 00 00 59 48 83 E9 09 | MZER GetPC stub @ offset 0 |
Techniques mapped across the full chain; full mappings and relationships ship in the STIX bundle.
The polyglot header is the strongest anchor — a genuine MZ image never has E8 at offset 4, so the false-positive rate is near zero. Full ruleset ships alongside this advisory as SL-ADV-2026-WP-002_omegatech.yar (5 rules, validated against both samples).
rule Omegatech_MZER_polyglot_header { // MZ-lookalike that is also a GetPC stub strings: $stub = { 4D 5A 45 52 E8 00 00 00 00 59 48 83 E9 09 48 8B C1 48 05 } condition: $stub at 0 }
# Network dst_ip == 158.94.211.92 uri contains "/enterprise/my_sss.bin" uri contains "/c0g1k2s3" # Host behavior powershell → child MZ image in memory svchost.exe ← CreateRemoteThread (external) process loading mscoree.dll from a non-.NET, non-signed binary
SL-ADV-2026-WP-002_omegatech.stix.json — 2 malware, 7 indicators, 21 attack-patterns, 34 relationships) and the YARA ruleset accompany this report for direct ingestion into OTX / TAXII downstream consumers.