type: incident · created: 2026-09-06 · updated: 2026-09-06 · tags: [incident, campaign, malware, clickfix, blockchain, supply-chain] · confidence: high · affected_sectors: [technology, retail] · au_impact: false
Over 5,400 Hacked Sites Serve ClickFix Payloads Stored on the Blockchain
Summary
Netskope researchers documented a large-scale cybercriminal operation using more than 5,400 compromised small-business websites — mostly WordPress and PrestaShop — to deliver ClickFix payloads staged inside smart contracts on the Binance Smart Chain (BSC) Testnet, a technique known as EtherHiding that makes the infrastructure resilient to takedown.
Key Facts
- Delivery: Visitors see a fake CAPTCHA lure instructing them to paste a PowerShell command into the Windows Run dialog, which downloads and executes the final payload.
- Persistence: Because the payload lives in a smart contract, the operator can re-write it at any time without touching the compromised sites.
- Escalation: Later in the campaign the ClickFix payload was swapped for a WebRTC data-channel stager that hand-writes its own session-description answer to open an encrypted channel to a hardcoded C2 and executes received JavaScript in browser memory without touching disk.
- Scale: Telemetry shows roughly 400 sites contacting the BSC Testnet RPC endpoint daily in August, peaking at 536.
Significance
The campaign illustrates the shift toward blockchain-hosted malware as a takedown-resistant distribution layer, compounding an already-prolific ClickFix social-engineering delivery pattern. Netskope recommends blocking the BSC Testnet RPC endpoint pool and monitoring non-web UDP WebRTC traffic.