5,400+ Sites Hacked in Blockchain ClickFix Scheme

In an ongoing campaign that blends old-school website compromises with blockchain-based infrastructure, threat actors have turned thousands of small-business websites into delivery points for malware. Researchers at Netskope say they've tracked more than 5,400 hacked sites, most running WordPress or PrestaShop, each injected with a script that pulls its next-stage payload from a smart contract on the BNB Smart Chain (BSC) Testnet.

The technique, known as EtherHiding, is not new—it has been observed in previous attacks—but the scale and the daily churn of infected sites make this operation stand out. The attackers are not just defacing pages or planting a single piece of code; they are maintaining a resilient, constantly updated infrastructure that is difficult to shut down.

EtherHiding: Malware on the Blockchain

EtherHiding is a method where malicious code or configuration data is stored in blockchain smart contracts. Because the blockchain is decentralized and immutable, takedown efforts are complicated. The BSC Testnet, designed for developers, functions similarly to the mainnet but is free to use, providing an inexpensive and hard-to-censor hosting layer for the attackers.

Netskope's analysis explains that the testnet endpoint is used to store the next-stage payload, which the injected script retrieves. This allows the attackers to change the payload at any time by updating the smart contract, making the attack adaptable and harder to block with static signatures.

ClickFix Lures and Fake CAPTCHAs

The delivery chain begins when a visitor lands on a compromised site. The injected script displays a ClickFix lure—a fake CAPTCHA that instructs the user to open the Windows Run dialog and paste a PowerShell command. This social engineering trick is designed to trick the user into executing the malicious payload themselves, bypassing many security controls.

If the user complies, the PowerShell command downloads and executes the final payload on the machine. Because the payload is stored in the smart contract, the attackers can modify it at any time, swapping in new malware or updating the command-and-control (C2) infrastructure as needed.

The WebRTC Twist

Later in the campaign, Netskope observed the attackers replacing the ClickFix payload in the smart contract with a WebRTC data-channel stager. This newer variant establishes a covert encrypted channel to the attacker and executes received code.

“The script creates a peer connection and a data channel, then generates the required session description offer just like a normal WebRTC handshake,”

Netskope explains in its analysis.

“But instead of sending that offer anywhere and waiting for a real reply, it hand-writes the answer itself and feeds it straight back into the connection. This way, no handshake happens, but a data channel to the cyberattacker still opens.”

The stager receives JavaScript code from a hardcoded C2 address, buffers it, and executes it when the channel closes or after ten seconds. The received code is assembled in the browser memory and executed dynamically without being saved to disk by adding it to the head of the DOM.

Scale of the Operation

Netskope warns that the operation uses more than 300 infected websites every day. Since spring, the number of compromised sites contacting the BSC Testnet RPC endpoints has grown constantly. Telemetry data shows that nearly 400 websites called the endpoint every day in August, with an all-time peak of 536.

• Over 5,400 hacked websites identified in the campaign.
• More than 300 infected websites used daily.
• Nearly 400 websites contacted the BSC Testnet RPC endpoint every day in August.
• All-time peak of 536 websites in a single day.

Recommendations for Defenders

Netskope recommends that defenders block the entire pool of BSC testnet RPC endpoints (a list is provided in their advisory) and monitor for non-web UDP traffic associated with WebRTC. These steps can help detect and mitigate the attack chain before the final payload is delivered.

Because the initial compromise method remains unknown, website owners should also audit their content management systems for unauthorized changes and ensure that all plugins and themes are up to date.

Why This Matters

The use of blockchain smart contracts to host malicious payloads represents a growing challenge for security teams. Traditional takedown methods, which rely on identifying and removing malicious servers, are less effective when the infrastructure is decentralized. The ability to update payloads on the fly also complicates detection and response efforts.

For website owners, the attack highlights the importance of securing their platforms against unknown vulnerabilities, as even a small business site can become a stepping stone for larger operations. As Netskope notes in its report, this campaign shows how attackers are continually adapting their techniques to stay ahead of defenders. The shift from ClickFix to WebRTC-based stagers is just one example of that evolution, suggesting that future variations may be even harder to spot.