Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain

Summary

A large cybercriminal operation is using over 5,400 compromised websites, primarily WordPress and PrestaShop, to distribute ClickFix malware. The payloads are stored in smart contracts on the BNB Smart Chain (BSC) Testnet, a technique called EtherHiding, making the infrastructure resilient. The malware lures victims with a fake CAPTCHA, prompting them to run a PowerShell command that downloads the final payload. Later variants replaced ClickFix with a WebRTC stager for covert, encrypted communication.

Full text

Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain By Bill Toulas September 5, 2026 10:29 AM 0 A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC). Over the past months, researchers identified more than 5,400 hacked websites, most of them built on WordPress and PrestaShop. The initial compromise method remains unknown, but each site was injected with a script that gets the next-stage payload from a smart contract on the BSC Testnet endpoint, a technique known as EtherHiding. Researchers at cloud security platform Netskope explain that the BSC Testnet is designed for developers and functions similarly to the mainnet, the production blockchain, but is available free of charge. Threat actors use the EtherHiding technique to store malicious code or configuration data in blockchain smart contracts, providing a resilient infrastructure that is difficult to take down. In the delivery chain observed by Netskope, the script displays a ClickFix lure that shows a fake CAPTCHA and instructs visitors to open the Windows Run dialog and paste a PowerShell command. Loading the ClickFix lureSource: Netskope Doing so downloads and executes the final payload on the machine. Because the attacker stores the payload in a smart contract, they can modify it at any time. The researchers note that later in the campaign, the threat actor replaced the ClickFix payload in the smart contract with a WebRTC data-channel stager. In the newer variant, the payload establishes a covert encrypted channel to the attacker and executes the received code. “The script creates a peer connection and a data channel, then generates the required session description offer just like a normal WebRTC handshake,” Netskope explains. “But instead of sending that offer anywhere and waiting for a real reply, it hand-writes the answer itself and feeds it straight back into the connection. This way, no handshake happens, but a data channel to the cyberattacker still opens.” Source: Netskope The stager receives JavaScript code from the hardcoded command-and-control (C2) address, buffers it, and executes it when the channel closes or after ten seconds. Received code is assembled in the browser memory and executed dynamically without being saved to disk by adding it to the head of the DOM Netskope warns that the operation uses more than 300 infected websites every day. Since spring, the number of compromised sites contacting the BSC Testnet RPC endpoints has grown constantly. Telemetry data shows that nearly 400 websites called the endpoint every day in August, with an all-time peak of 536. The security researchers recommend that defenders block the entire pool of BSC testnet RPC endpoints provided here and monitor for non-web UDP traffic associated with WebRTC. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: WordPress backup plugin flaw exposes millions of sites to takeover attacksCronos blockchain restarts after $74 million Tectonic exploitMicrosoft warns of TerminalFix attacks deploying reverse tunnelsDeadLock ransomware uses blockchain to resist infrastructure takedownNew Infinity Stealer malware grabs macOS data via ClickFix lures

Indicators of Compromise

• domain — bsc.testnet.rpc.com
• malware — ClickFix
• malware — WebRTC data-channel stager

Entities