Hackers Hide ClickFix Malware in Blockchain Smart Contracts on 5,400 Sites
A large-scale cybercriminal operation compromises more than 5,400 hacked websites, mostly small businesses built on WordPress and PrestaShop, to deliver ClickFix payloads stored on the BNB Smart Chain (BSC) Testnet. Researchers at Netskope say the initial compromise method remains unknown, but each site carries an injected script that pulls the next-stage payload from a smart contract, a technique known as EtherHiding.
Because the BSC Testnet is free and works like the production blockchain, threat actors use it to store malicious code in smart contracts, creating resilient infrastructure that is difficult to take down. The script displays a ClickFix lure with a fake CAPTCHA that tricks visitors into opening the Windows Run dialog and pasting a PowerShell command, which downloads and executes the final payload. Since the payload lives in the smart contract, the attacker can swap it at any time.
Later in the campaign, the actor replaces the ClickFix payload with a WebRTC data-channel stager that establishes a covert encrypted channel and executes received code. The stager buffers JavaScript from a hardcoded C2 address and runs it dynamically in browser memory without writing to disk. Netskope reports that the operation leverages more than 300 infected websites every day.