Over 5,400 Hacked Websites Serve ClickFix Malware Stored on Blockchain

Researchers at Netskope have identified a large-scale campaign in which threat actors inject compromised websites with a script that retrieves a next-stage payload from a smart contract on the BSC Testnet, a technique known as EtherHiding. The attacker’s initial method of compromise remains unknown.

Once a visitor lands on an infected site, the script displays a fake CAPTCHA and instructs them to open the Windows Run dialog and paste a PowerShell command. Executing the command downloads and runs the final payload. Because the payload is stored in a smart contract, the attacker can modify it at any time.

Later in the campaign, the threat actor replaced the ClickFix payload with a WebRTC data-channel stager. This variant creates a peer connection and a data channel, then hand-writes the session description answer, bypassing a real handshake and opening a covert encrypted channel to the attacker. The stager downloads JavaScript code from a hardcoded command-and-control address, buffers it, and executes it in the browser’s memory without writing to disk.

Netskope reports that the operation uses more than 300 infected websites daily. Telemetry data from August shows nearly 400 compromised sites contacting the BSC Testnet endpoints each day, with an all-time peak of 536. The security firm recommends that defenders block connections to BSC Testnet RPC endpoints to mitigate the threat.

Why This Matters

Small business websites are being weaponized without their owners’ knowledge, potentially damaging their reputation and exposing visitors to malware.
Storing payloads on the blockchain makes the campaign’s infrastructure extremely difficult to shut down, as smart contracts are decentralized and immutable.
The shift from ClickFix to WebRTC stagers shows the attackers are actively evolving their methods to evade detection.

Background

EtherHiding is a technique that uses blockchain smart contracts to host malicious scripts or configuration data, first observed in campaigns by North Korean state-sponsored hackers. ClickFix is a social engineering lure that tricks users into running a malicious command by presenting a fake CAPTCHA or error message. The BNB Smart Chain Testnet is a free development environment that mirrors the mainnet, allowing attackers to avoid transaction costs.

Key Perspectives

Small business owners: Their compromised websites are used as unwitting distribution points, potentially leading to legal liability and loss of customer trust. Security researchers (Netskope): They emphasize the growing trend of using blockchain for malware delivery and call for defenders to monitor outbound connections to testnet endpoints. Threat actors: The use of smart contracts gives them a resilient, rapidly updatable infrastructure that can be difficult for law enforcement to disrupt.

What to Watch

Whether the campaign expands to include the BSC mainnet, which would be more costly but harder to block.
An increase in the number of compromised websites, as the current daily count of over 300 shows no signs of slowing.
Emergence of new payload variants, such as fileless malware or ransomware, delivered via the same stager.

ZOTPAPER