TA584 Actors Leveraging ClickFix Social Engineering to Deliver Tsundere Bot Malware

TA584 has been observed distributing a new Node.js-based malware called Tsundere Bot via sophisticated phishing lures and the ClickFix social-engineering flow; the malware uses EtherHiding (retrieving configuration from Ethereum smart contracts), enforces geofencing/anti-analysis checks, can lead to ransomware deployment, and communicates with a reported C2 at 193.17.183.126:3001.