Hackers Abuse Compromised WordPress Sites to Deliver GULoader Through EtherHiding Chain

A sophisticated ClickFix campaign implanted an ErrTraffic-style mu-plugin in WordPress sites to serve EtherHiding JavaScript that fetched payloads from BSC Testnet smart contracts and social-engineered Windows users into running a UNC-based rundll32 load that attempted to initialize GULoader; combined ANY.RUN sandbox and EDR telemetry tied the chain to specific domains and Cloudflare-backed IPs, and Elastic Defend behavioral detection terminated the process before the loader completed initialization, with IOCs and defensive lessons provided.