Table of Contents
Introduction
A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC) blockchain.
Over the past months, researchers have identified more than 5,400 hacked websites, most of them built on WordPress and PrestaShop. This represents one of the largest and most innovative malware delivery campaigns seen in recent years.
Over 5,400 compromised websites are actively serving ClickFix payloads stored on the blockchain — a technique that makes the malware infrastructure nearly impossible to take down.
What Is EtherHiding?
EtherHiding is a technique where threat actors store malicious code or configuration data in blockchain smart contracts. This provides a resilient infrastructure that is difficult to take down because blockchain data is decentralized and immutable.
In this campaign, attackers use the BSC Testnet — a free blockchain network designed for developers — to host their payloads at no cost. The testnet functions similarly to the production mainnet but is available free of charge.
The BSC Testnet is designed for developers and functions similarly to the mainnet, the production blockchain, but is available free of charge. Attackers exploit this to store malicious payloads at no cost.
Campaign Overview — Over 5,400 Sites Hacked
Researchers at Netskope have been tracking this campaign since spring 2026. Key findings include:
- 5,400+ compromised websites identified
- Most sites are built on WordPress and PrestaShop
- Initial compromise method remains unknown
- Each site was injected with a script that retrieves payloads from the BSC Testnet
- 300+ infected sites are active every day
- Nearly 400 sites called the BSC Testnet endpoint daily in August
- All-time peak of 536 sites in a single day
Since spring, the number of compromised sites contacting the BSC Testnet RPC endpoints has grown constantly, with nearly 400 sites calling the endpoint every day in August.
How the Attack Works
The attack chain is sophisticated and leverages multiple technologies:
- Website compromise — Attackers compromise WordPress or PrestaShop sites using an unknown method
- Script injection — A malicious script is injected into each compromised site
- Blockchain payload retrieval — The script fetches the next-stage payload from a smart contract on the BSC Testnet
- ClickFix lure displayed — Visitors see a fake CAPTCHA prompting them to open the Windows Run dialog
- PowerShell command — Users are instructed to paste a PowerShell command
- Malware execution — The PowerShell command downloads and executes the final payload
Because the attacker stores the payload in a smart contract, they can modify it at any time — making the malware adaptable and persistent.
The ClickFix Lure
The attack uses a ClickFix social engineering technique to trick users into executing malicious code.
How the ClickFix lure works:
- The compromised site displays a fake CAPTCHA to the visitor
- The user is instructed to open the Windows Run dialog (Win+R)
- They are told to paste a PowerShell command
- The PowerShell command downloads and executes the final payload
ClickFix is a social engineering technique that tricks users into manually executing malicious code. Always verify the source of any instructions that ask you to run commands on your computer.
WebRTC Data-Channel Stager
In a later evolution of the campaign, the threat actor replaced the ClickFix payload with a WebRTC data-channel stager.
How the WebRTC stager works:
- The payload establishes a covert encrypted channel to the attacker
- The script creates a peer connection and a data channel
- It generates the required session description offer — just like a normal WebRTC handshake
- Instead of sending the offer anywhere, it hand-writes the answer itself and feeds it back into the connection
- No actual handshake happens, but a data channel to the attacker still opens
- The stager receives JavaScript code from a hardcoded C2 address
- Code is assembled in browser memory and executed dynamically without being saved to disk
"The script creates a peer connection and a data channel, then generates the required session description offer just like a normal WebRTC handshake. But instead of sending that offer anywhere and waiting for a real reply, it hand-writes the answer itself and feeds it straight back into the connection." — Netskope
Campaign Scale
The scale of this campaign is significant and growing:
- 5,400+ sites compromised since spring 2026
- 300+ sites active daily
- Nearly 400 sites calling the BSC Testnet endpoint daily in August
- All-time peak of 536 sites in a single day
- Constant growth in the number of compromised sites
The operation uses more than 300 infected websites every day. Since spring, the number of compromised sites contacting the BSC Testnet RPC endpoints has grown constantly.
How to Protect Your Business
Steps to protect your organization from this campaign:
1. Block BSC Testnet RPC Endpoints
- Block the entire pool of BSC testnet RPC endpoints
- Implement network filtering to prevent connections to known malicious blockchain endpoints
2. Monitor for WebRTC Traffic
- Monitor for non-web UDP traffic associated with WebRTC
- WebRTC can be used to establish covert channels
- Implement inspection for unusual WebRTC connections
3. Secure Your Websites
- Keep WordPress and PrestaShop updated
- Use strong passwords and implement MFA for admin accounts
- Install security plugins and perform regular scans
- Regularly audit injected scripts and unknown code
4. Educate Employees
- Train staff to recognize ClickFix lures
- Never run PowerShell commands from untrusted sources
- Verify website legitimacy before following instructions
- Report suspicious websites to IT teams
5. Implement Endpoint Protection
- Use EDR solutions to detect malicious script execution
- Monitor for PowerShell execution from web browsers
- Implement application whitelisting where possible
Taking these steps can significantly reduce your organization's risk from blockchain-hosted malware campaigns and ClickFix attacks.
Final Thoughts
The campaign using 5,400+ hacked sites to deliver blockchain-stored ClickFix payloads represents a significant evolution in cybercrime. By leveraging EtherHiding and WebRTC, attackers have created a resilient, difficult-to-takedown infrastructure that continuously adapts.
Key takeaways:
- 5,400+ hacked sites — mostly WordPress and PrestaShop
- Blockchain-hosted payloads — stored on BSC Testnet, making takedown difficult
- ClickFix lures — trick users into running PowerShell commands
- WebRTC stagers — establish covert encrypted channels
- Growing scale — 300+ sites active daily, growing constantly
- Protection — block BSC endpoints, monitor WebRTC, secure websites
If your business needs assistance with website security, threat protection, or incident response, contact SystemLogicIT for expert guidance.