Over 5,400 Hacked Sites Serve ClickFix Payloads Stored on the Blockchain

Summary

Netskope researchers documented a large-scale cybercriminal operation using more than 5,400 compromised small-business websites — mostly WordPress and PrestaShop — to deliver ClickFix payloads staged inside smart contracts on the Binance Smart Chain (BSC) Testnet, a technique known as EtherHiding that makes the infrastructure resilient to takedown.

Key Facts

• Delivery: Visitors see a fake CAPTCHA lure instructing them to paste a PowerShell command into the Windows Run dialog, which downloads and executes the final payload.
• Persistence: Because the payload lives in a smart contract, the operator can re-write it at any time without touching the compromised sites.
• Escalation: Later in the campaign the ClickFix payload was swapped for a WebRTC data-channel stager that hand-writes its own session-description answer to open an encrypted channel to a hardcoded C2 and executes received JavaScript in browser memory without touching disk.
• Scale: Telemetry shows roughly 400 sites contacting the BSC Testnet RPC endpoint daily in August, peaking at 536.

Significance

The campaign illustrates the shift toward blockchain-hosted malware as a takedown-resistant distribution layer, compounding an already-prolific ClickFix social-engineering delivery pattern. Netskope recommends blocking the BSC Testnet RPC endpoint pool and monitoring non-web UDP WebRTC traffic.

Source

• BleepingComputer — Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain

Related pages

• ClickFix — the underlying technique, its on-chain delivery pattern and the countermeasure mapping