A large-scale cybercriminal operation is leveraging thousands of compromised small-business websites to distribute malicious ClickFix payloads hidden inside smart contracts on the BNB Smart Chain (BSC), security researchers have reported.

Over recent months, researchers have identified more than 5,400 compromised websites involved in the campaign. Most of the affected sites were built on WordPress and PrestaShop, two widely used platforms for small-business websites; WordPress alone powers a substantial share of the web, and both platforms have historically been targeted by attackers exploiting outdated plugins, weak credentials, and unpatched installations. How the attackers initially gained access to these sites remains unclear.

Once a site is compromised, the attackers inject a script that retrieves additional malicious content from a smart contract via a BSC Testnet remote procedure call endpoint. This technique is known as EtherHiding, in which threat actors use blockchain infrastructure to conceal malicious code or configuration data. EtherHiding was first publicly documented by researchers in 2024, and its reuse here against BSC infrastructure illustrates how the approach has persisted and adapted across different chains.

Attackers Exploit Blockchain Infrastructure

The BSC Testnet is intended primarily for developers testing applications before deploying them to the production blockchain. Because it operates much like the mainnet while avoiding the costs associated with production transactions, it offers attackers a convenient infrastructure for distributing malicious content. Because blockchain data is replicated across many nodes and is difficult to unilaterally delete, takedowns that work against conventional hosting providers are far harder to execute against contract-stored payloads.

By storing malicious payloads inside smart contracts, the attackers gain an infrastructure layer that is difficult to disrupt, since the content can be retrieved through decentralized blockchain systems rather than depending entirely on conventional web hosting.

The campaign initially used the compromised websites to display a ClickFix social-engineering lure. Visitors were shown what appeared to be a CAPTCHA verification page. Rather than completing a normal verification process, users were instructed to open the Windows Run dialog and paste a PowerShell command. If a visitor followed those instructions, the command downloaded and executed the final malicious payload on their computer. ClickFix-style lures — fake verification or update prompts that trick users into pasting commands themselves — have become a widely reported social-engineering technique over the past year, in part because the victim executes the action directly, bypassing many browser-based protections.

Because the attackers controlled the content stored in the smart contract, they could update the payload without modifying every compromised website. Researchers later observed a significant change in the delivery mechanism: the threat actor replaced the ClickFix payload stored in the smart contract with a WebRTC-based stager, introducing a new method for establishing communication with the attacker.

WebRTC Used for Covert Code Delivery

The newer variant creates a peer connection and a WebRTC data channel. Researchers found that the script generates a session-description offer resembling a legitimate WebRTC connection process, but then constructs the corresponding response itself rather than communicating with a genuine remote peer. This technique allows the malicious script to establish a data channel without completing a conventional WebRTC handshake, and the resulting channel serves as a covert communication path with the attacker. WebRTC is a standard browser technology normally used for video calls and peer-to-peer file transfer, which helps malicious traffic blend in with legitimate web activity.

The stager contains a hardcoded command-and-control address from which it receives JavaScript code. The incoming code is buffered in memory and executed after the communication channel closes or after a 10-second interval. The received JavaScript is assembled directly in browser memory and executed dynamically through the document object model, allowing the code to run without ever being written to disk.

This approach can make traditional endpoint detection more difficult, because the malicious code does not necessarily appear as a conventional file on the victim's system. It also gives the attackers flexibility to change the code delivered to visitors.

More Than 300 Websites Active Each Day

Netskope's telemetry indicates the campaign remains active at substantial scale. Researchers said more than 300 infected websites have been involved in the operation daily, while the number of compromised sites communicating with BSC Testnet remote procedure call endpoints has continued to increase since the spring. During August, telemetry showed nearly 400 websites contacting the relevant endpoints each day, and the campaign reached an all-time daily peak of 536 websites.

The findings highlight how blockchain infrastructure can be repurposed as part of a malware distribution network. Rather than relying solely on conventional command-and-control servers or content-hosting services, the attackers are combining compromised websites, smart contracts, and browser-based communication mechanisms. For small-business site owners, the campaign also underscores the operational risk of running unmaintained CMS installations, since compromised sites can silently serve malicious content to their own visitors.

Netskope recommends that defenders block the pool of BSC Testnet remote procedure call endpoints associated with the campaign. Security teams are also advised to monitor network activity for non-web UDP traffic linked to WebRTC, which could help identify systems participating in the newer delivery mechanism.

Source: CoinTrust