#ParsedReport #CompletenessMedium
15-09-2026

ClickFix + EtherHiding Targets Anglophone Countries with NightshadeC2/CastleRAT

https://www.watchguard.com/wgrd-security-hub/secplicity-blog/clickfix-etherhiding-targets-anglophone-countries-0

Report completeness: Medium

Actors/Campaigns:
Graybravo

Threats:
Clickfix_technique
Etherhiding_technique
Nightshade
Motw_bypass_technique
Dead_drop_technique
Dll_injection_technique
Credential_stealing_technique

Victims:
Windows users

Geo:
Russian, Ireland, Australia, New zealand, United kingdom, United states, Canada

TTPs:
Tactics: 3
Technics: 12

IOCs:
File: 8
Command: 6
Domain: 12
IP: 1

Soft:
WordPress, Cloudflare R2, Chrome, Steam, Chromium, Telegram, Discord

Crypto:
ethereum

Algorithms:
base64, zip, aes-256, aes-256-cbc, rc4, aes-gcm, chacha20

Functions:
atob, JavaScript, eval, cmd_run, Powershell, SetWindowsHookEx, MFEnumDeviceSources, It, NtDuplicateObject

Win API:
VirtualProtect, SendInput, AddClipboardFormatListener

Languages:
java, python, powershell, javascript