A large-scale cybercrime campaign is using thousands of compromised small business websites to distribute ClickFix malware through malicious code stored in blockchain smart contracts.
Security researchers have identified more than 5,400 hacked websites involved in the operation. Most of the compromised sites use WordPress or PrestaShop.
Although the initial method used to compromise the websites remains unknown, attackers injected a script into each site. The script retrieves the next-stage payload from a smart contract hosted through a BNB Smart Chain (BSC) Testnet endpoint.
This technique, known as EtherHiding, allows threat actors to conceal malicious code and configuration data inside blockchain smart contracts. Because blockchain infrastructure is decentralized and difficult to take down, it can provide attackers with a resilient command-and-control mechanism.
Researchers at cloud security company Netskope say the BSC Testnet is intended for developers and operates similarly to the live BSC mainnet, but is free to use.
In the campaign analyzed by Netskope, the injected script displays a ClickFix social engineering lure featuring a fake CAPTCHA. Victims are instructed to open the Windows Run dialog and paste a PowerShell command, believing the action is required to verify that they are human.
Source: Netskope
The command downloads and executes the final malware payload on the victim’s Windows computer. Since the attackers store the payload in a blockchain smart contract, they can modify or replace it without changing the compromised websites.
Netskope researchers observed that the attackers later replaced the ClickFix payload in the smart contract with a WebRTC data channel stager.
In these newer variants, the stager creates an encrypted communication channel with the attackers and executes JavaScript received through that connection.
“The script creates the peer connection and data channel, and generates the necessary session description offers just like a normal WebRTC handshake.” Netskope explains.
“But instead of sending that offer everywhere and waiting for an actual response, [the attackers] write the answer by hand and send it directly back to the connection. This method does not cause a handshake, but leaves the data channel open to the cyber attacker.”
The WebRTC stager receives JavaScript from a hardcoded command-and-control (C2) address and stores the code in memory. It executes the code when the communication channel closes or after 10 seconds.
The JavaScript is assembled directly in the browser’s memory and inserted at the beginning of the document object model (DOM). This allows the code to run dynamically without being written to disk.
Netskope warns that the campaign uses more than 300 infected websites each day. Since the spring, the number of compromised sites connecting to BSC Testnet remote procedure call (RPC) endpoints has continued to increase.
Telemetry shows that nearly 400 websites contacted the endpoints each day in August, with a peak of 536 compromised websites.
To help detect and block the campaign, security teams should consider blocking the known BSC Testnet RPC endpoint pool and monitoring non-web UDP traffic associated with WebRTC. Netskope’s ClickFix indicators of compromise are available here.
Overall prevention scores can obscure what happens after an attacker gains initial access. If threat actors obtain valid credentials, an organization’s defenses can weaken significantly.
The Blue Report 2026 evaluates cybersecurity defense techniques across technologies using 338 million simulations conducted in customer production environments.
Source: www.bleepingcomputer.com