A large-scale cybercriminal campaign is using thousands of compromised small-business websites to distribute malicious ClickFix payloads hosted inside smart contracts on the BNB Smart Chain (BSC), according to security researchers.
Over recent months, researchers have identified more than 5,400 compromised websites involved in the operation. Most of the affected sites were built using WordPress and PrestaShop, two widely used platforms for small-business websites. The method used by the attackers to initially gain access to the sites remains unclear.
Once a website is compromised, attackers inject a script designed to retrieve additional malicious content from a smart contract through a BSC Testnet remote procedure call endpoint. The approach is known as EtherHiding, in which threat actors use blockchain infrastructure to conceal malicious code or configuration information.
Attackers Exploit Blockchain Infrastructure
The BSC Testnet is intended primarily for developers testing applications before deploying them on the production blockchain. Because it operates similarly to the mainnet while being available without the same costs associated with production transactions, it can provide attackers with a convenient infrastructure for distributing malicious content.
By placing malicious payloads inside smart contracts, attackers gain an infrastructure layer that is difficult to disrupt because the content can be retrieved through decentralized blockchain systems rather than relying entirely on conventional web hosting.
The campaign initially used compromised websites to display a ClickFix social-engineering lure. Visitors were presented with what appeared to be a CAPTCHA verification page. Instead of completing a conventional verification process, users were instructed to open the Windows Run dialog and paste a PowerShell command.
If a visitor followed those instructions, the command downloaded and executed the final malicious payload on the computer. Because the attackers controlled the content stored in the smart contract, they could also update the payload without having to modify every compromised website.
Security researchers later observed a significant change in the delivery mechanism. The threat actor replaced the ClickFix payload stored in the smart contract with a WebRTC-based stager, introducing a different method for establishing communication with the attacker.
WebRTC Used for Covert Code Delivery
The newer variant creates a peer connection and a WebRTC data channel. Researchers found that the script generates a session-description offer resembling a legitimate WebRTC connection process but then constructs the corresponding response itself rather than communicating with a genuine remote peer.
This technique allows the malicious script to establish a data channel without completing a conventional WebRTC handshake. The resulting channel is then used as a covert communication path with the attacker.
The stager contains a hardcoded command-and-control address from which it receives JavaScript code. The incoming code is buffered in memory and executed after the communication channel closes or after a 10-second interval.
The received JavaScript is assembled directly in browser memory and executed dynamically through the document object model, allowing the code to run without first being written to disk.
The approach can make traditional endpoint detection more difficult because the malicious code does not necessarily appear as a conventional file on the victim’s system. It also gives the attackers flexibility to change the code delivered to visitors.
More Than 300 Websites Active Each Day
Netskope’s telemetry indicates that the campaign remains active at substantial scale. Researchers said more than 300 infected websites have been involved in the operation on a daily basis, while the number of compromised sites communicating with BSC Testnet remote procedure call endpoints has continued to increase since the spring.
During August, telemetry showed that nearly 400 websites were contacting the relevant endpoints each day. The campaign reached an all-time daily peak of 536 websites.
The findings highlight how blockchain infrastructure can be repurposed as part of a malware distribution network. Rather than depending solely on conventional command-and-control servers or content-hosting services, the attackers are combining compromised websites, smart contracts, and browser-based communication mechanisms.
Netskope recommends that defenders block the pool of BSC Testnet remote procedure call endpoints associated with the campaign. Security teams are also advised to monitor network activity for non-web UDP traffic linked to WebRTC, which could help identify systems participating in the newer delivery mechanism.
