ClickFix Campaign Uses EtherHiding and GULoader to Infect Windows Users via Fake CAPTCHA
cybersecuritynews.com Jun 17, 2026

ClickFix Campaign Uses EtherHiding and GULoader to Infect Windows Users via Fake CAPTCHA

AI-summarised brief · reviewed before publication

A new cyberattack campaign, dubbed ClickFix, has been targeting Windows users through fake CAPTCHA pages since April 2026. The campaign combines three techniques - EtherHiding, a blockchain-based payload method; ClickFix, a social engineering trick; and GULoader, a memory-based malware downloader - to evade standard security defenses. The attack begins on a compromised European small-business website and ends with an attempt to load GULoader onto a victim's machine. The campaign targets users who arrive at a legitimate-looking website through a Google search, with no phishing email or suspicious link involved.

💡 Why It Matters

  • · This campaign highlights the growing sophistication of cyber threats, where attackers blend into normal browsing to deceive both users and automated security tools.
  • · The use of legitimate-looking websites and blockchain-based payload methods makes it challenging for traditional defenses to detect the attack, underscoring the need for more advanced threat detection techniques.