OCRFix: When Fake CAPTCHAs, AI, and Blockchains Collide to Build a Botnet

OCRFix is a deceptive multi-stage malware campaign that impersonates the Tesseract OCR project via a typosquatted site and LLM-poisoned search results. Victims are tricked with a faux CAPTCHA to paste a PowerShell command, which launches a loader that retrieves further stages; subsequent payloads create persistence, disable defenses (including Windows Defender exclusions and BitLocker weakening), and install a listener that contacts C2 endpoints hidden in BNB Smart Chain TestNet smart contracts ("EtherHiding") for remote control and botnet use.