A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC).
Over the past months, researchers identified more than 5,400 hacked websites, most of them built on WordPress and PrestaShop.
The initial compromise method remains unknown, but each site was injected with a script that gets the next-stage payload from a smart contract on the BSC Testnet endpoint, a technique known as EtherHiding.
Researchers at cloud security platform Netskope explain that the BSC Testnet is designed for developers and functions similarly to the mainnet, the production blockchain, but is available free of charge.
Threat actors use the EtherHiding technique to store malicious code or configuration data in blockchain smart contracts, providing a resilient infrastructure that is difficult to take down.
In the delivery chain observed by Netskope, the script displays a ClickFix lure that shows a fake CAPTCHA and instructs visitors to open the Windows Run dialog and paste a PowerShell command.
Doing so downloads and executes the final payload on the machine. Because the attacker stores the payload in a smart contract, they can modify it at any time.
The researchers note that later in the campaign, the threat actor replaced the ClickFix payload in the smart contract with a WebRTC data-channel stager.
In the newer variant, the payload establishes a covert encrypted channel to the attacker and executes the received code.
“The script creates a peer connection and a data channel, then generates the required session description offer just like a normal WebRTC handshake,” Netskope explains.
“But instead of sending that offer anywhere and waiting for a real reply, it hand-writes the answer itself and feeds it straight back into the connection. This way, no handshake happens, but a data channel to the cyberattacker still opens.”
The stager receives JavaScript code from the hardcoded command-and-control (C2) address, buffers it, and executes it when the channel closes or after ten seconds.
Received code is assembled in the browser memory and executed dynamically without being saved to disk by adding it to the head of the DOM
Netskope warns that the operation uses more than 300 infected websites every day. Since spring, the number of compromised sites contacting the BSC Testnet RPC endpoints has grown constantly.
Telemetry data shows that nearly 400 websites called the endpoint every day in August, with an all-time peak of 536.
The security researchers recommend that defenders block the entire pool of BSC testnet RPC endpoints provided here and monitor for non-web UDP traffic associated with WebRTC.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now