OCRFix Botnet Uses ClickFix Phishing and EtherHiding to Mask Blockchain C2 Infrastructure

OCRFix is a multi-stage botnet Trojan delivered through a typosquatted Tesseract OCR site that tricks users into pasting PowerShell commands; the attack chain drops an MSI that installs three staged executables (loader, persistence/evader, bot listener). Operators use EtherHiding on the BNB Smart Chain to host rotating C2 data, and the malware disables defenses, adds Defender exclusions, and beacons periodically; the report includes domains and SHA1 IOCs.