More than 5,400 hacked websites, most running WordPress or PrestaShop, are being used in a large-scale campaign that delivers ClickFix malware payloads stored on the BNB Smart Chain (BSC) blockchain. Researchers at cloud security firm Netskope said the compromised sites, mainly belonging to small businesses, have been injected with a script that pulls the next-stage payload from a smart contract on the BSC Testnet endpoint. This technique, known as EtherHiding, allows the attackers to store malicious code in blockchain smart contracts, making their infrastructure highly resilient and difficult to shut down.
The BSC Testnet is designed for developers and operates like the mainnet production blockchain, but it is free to use. Netskope’s analysis shows that the delivery chain begins when the injected script displays a fake CAPTCHA to visitors as a ClickFix lure. The fraudulent prompt instructs users to open the Windows Run dialog and paste a PowerShell command, which then downloads and executes the final payload on their machine. Because the payload is stored in a smart contract, the threat actor can modify it at any time, allowing for rapid changes to the attack.
Later in the campaign, the researchers observed that the attacker replaced the ClickFix payload in the smart contract with a WebRTC data-channel stager. In this newer variant, the payload creates a peer connection and data channel, then generates a session description offer as in a normal WebRTC handshake. However, instead of sending that offer to a real peer, the script constructs the answer itself and feeds it back into the connection, opening a covert encrypted data channel to the attacker without an actual handshake. The stager then receives JavaScript code from a hardcoded command-and-control address, buffers it, and executes it when the channel closes or after ten seconds have passed.
The received code is assembled in the browser’s memory and executed dynamically without being written to disk, as it is added to the head of the document object model. Netskope warns that the operation is active on more than 300 infected websites every day, and the number of compromised sites contacting BSC Testnet RPC endpoints has grown steadily since spring. Telemetry data indicates that nearly 400 websites called the endpoint daily in August, reaching an all-time peak of 536. The initial method used to compromise these websites remains unknown, according to the researchers.
The researchers recommend that defenders block the entire pool of BSC testnet RPC endpoints and monitor for non-web UDP traffic associated with WebRTC, which could indicate malicious activity. Netskope also noted that overall prevention scores can obscure what happens after an attacker gains initial access, as prevention effectiveness drops sharply once valid credentials are in use. The company’s Blue Report 2026, which tracks defenses technique by technique across 338 million simulations run in customer production environments, highlights this gap. No information was provided on the specific identities of the victims or the final malware delivered in the campaign.
More cybersecurity news from TechManNews.
