Hunt IOC for EtherHiding in the Browser: Amatera ClickFix

Ankit Mehta@Secvyn

•updated Sep 7, 2026•2•0•2

Detects network connection attempts to specific external domains associated with suspicious JavaScript payloads. The rule filters for specific file paths (e.g., mpackage.js, bsc-loader.js) linked to known malicious or suspicious URL patterns on cdn.claritydelivr.com, rcrsinnovations.com, konverto.in, and cdn.api-middle-connect.com, which may indicate C2 beaconing or malware infection.