5,400 Hacked Sites Hide ClickFix Malware on Blockchain

Every takedown needs an address. A registrar to file with, an abuse desk to email, an IP to null route. Netskope spent August watching a malware operation that offers none of them: the script injected into thousands of hacked websites reaches into a public blockchain and pulls its next stage out of a smart contract. Nobody runs an abuse desk on a blockchain.

Key Takeaways

• Netskope documented more than 5,400 compromised websites, mostly WordPress and PrestaShop installations, serving ClickFix lures whose payload is stored on the BNB Smart Chain Testnet, in research reported on September 5, 2026 by BleepingComputer.
• More than 300 infected sites were live on any given day, and close to 400 of them called BSC testnet endpoints daily during August, with a single day peak of 536.
• EtherHiding stores the next stage inside a smart contract, so the operators can rewrite the payload across every infected site at once without ever touching the sites again.
• The lure is a fake CAPTCHA that tells the visitor to open the Windows Run dialog and paste a PowerShell command, which makes the victim the execution step.
• The campaign later swapped its payload for a WebRTC data channel stager that receives JavaScript from a hardcoded command and control address and runs it in browser memory, writing nothing to disk.

What Is EtherHiding?

EtherHiding is the practice of storing malicious code inside a smart contract on a public blockchain, so that compromised websites fetch their payload from the chain instead of from a server an investigator could seize.

Guardio Labs first documented the technique in October 2023, when Binance Smart Chain contracts pushed fake browser update prompts through hacked sites. It matured into a business. Google's threat intelligence team tracked a financially motivated group it calls UNC5142, which had roughly 14,000 web pages carrying EtherHiding injections by June 2025, feeding Atomic, Lumma, Rhadamanthys and Vidar to Windows and macOS victims through a loader named CLEARSHORT, per the Google Cloud threat intelligence writeup.

One detail has gone almost unmentioned, and it is the most interesting thing in the report. Earlier EtherHiding operators used the BNB mainnet, where every contract write burns real BNB. This crew moved to the testnet, where tokens come free from a faucet. Their delivery infrastructure therefore costs nothing to run and nothing to update, while every takedown request a defender files costs somebody an hour. The economics have been inverted, and that is a worse problem than the 5,400 sites.

How Does the ClickFix Lure Actually Work?

ClickFix shows the visitor a fake verification prompt and gives them instructions that end with the victim pasting an attacker supplied command into their own shell.

The chain in this campaign runs like this:

• A hacked WordPress or PrestaShop site loads an injected script for every visitor.
• The script queries a BSC testnet RPC endpoint and reads the current payload out of a smart contract.
• The visitor sees an overlay that looks like a routine CAPTCHA or a "verify you are human" step.
• The overlay tells them to press Win+R, paste, and press Enter. The clipboard already holds a PowerShell one liner.
• PowerShell downloads and executes the final malware. No file was ever downloaded and double clicked.

MITRE gave this its own sub technique in ATT&CK, T1204.004, Malicious Copy and Paste, and states the advantage plainly: tricking a user into executing a command themselves helps bypass email filtering, browser sandboxing and the other controls built to stop malicious downloads. We watched the same script play out in March when a fake CAPTCHA fix walked victims into Windows Terminal to deploy Lumma Stealer.

Why Does ClickFix Get Past Email Filters?

Because there is nothing in the message to scan. No attachment, no executable, no macro. Just a link to a real website that happens to have been compromised.

Victims reach these pages three ways: search results, malvertising, and links pasted into phishing mail. The third one is where inbox defenses are supposed to catch it, and they mostly cannot. A secure email gateway scores a URL on domain age, reputation and category. Every one of those 5,400 sites passes: they are established shops and blogs with clean histories that were broken into last week. Reputation scoring measures the owner, and the owner is a victim too.

Sandbox detonation does not save you either, because the malicious step happens outside the browser. A sandbox can visit the page, render the overlay and observe nothing worse than some JavaScript reading a blockchain, which is not by itself a crime. The command only runs when a human reads an instruction, alt tabs to their own desktop and types. That is the whole trick, and it is why ClickFix now sits second only to phishing as an initial access route. ESET measured a jump of more than 500% in ClickFix detections against the second half of 2024 in its H1 2025 threat report, and the technique kept climbing through 2026. If your threat model is built around attacks that begin in the browser rather than in the mail flow, this campaign is the reference implementation.

What Changed When the Payload Became a WebRTC Stager

The operators replaced the original ClickFix malware with a stager that opens an encrypted WebRTC data channel, receives JavaScript from a hardcoded command and control address, buffers it and executes it in browser memory.

Read that again from the perspective of your detection stack. Nothing lands on disk, so file based detection has no artifact to hash. The transport is not HTTP, so proxy logs stay quiet. WebRTC normally negotiates a peer connection through a signaling server, but Netskope found this stager hand writing the answer itself to skip the handshake, removing the one network component an investigator could subpoena.

Losing persistence is deliberate, not sloppy. A resident implant is something an EDR agent eventually finds on a scheduled scan. Code that exists only in a tab's memory until the tab closes gives you a window measured in minutes, and it returns the next time the user visits any of the 5,400 sites.

How Do You Defend Against This?

Since the delivery infrastructure cannot be taken down, defense moves to the two chokepoints that remain: the network call to the chain, and the user's ability to paste a command into a shell.

• Block the BSC testnet RPC endpoint pool outright. Netskope recommends blocking the whole pool rather than individual hosts, and published its indicator list in its public threat labs IOC repository. Almost no corporate endpoint has a legitimate reason to talk to a blockchain test network.
• Alert on non web UDP traffic consistent with WebRTC from hosts that have no business making peer connections.
• Restrict the Run dialog. User Configuration, Administrative Templates, System, "Restrict Run dialog access" removes the exact box every one of these lures depends on. It is the single highest leverage control against T1204.004.
• Turn on PowerShell script block logging through the PowerShell Group Policy settings, and forward Event ID 4104 centrally. Obfuscated one liners deobfuscate themselves in that log.
• Hunt the RunMRU key. Every pasted command leaves a value under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. It is one of the few durable artifacts this attack chain produces, and it is trivially queryable at scale.
• Patch and audit the CMS estate. The victims here are WordPress and PrestaShop sites with stale plugins, which is also how attackers seeded ClickFix onto more than 700 Ghost CMS sites in May.

What to Watch Next

The growth curve is worth stating plainly: 700 Ghost CMS sites in May became 5,400 WordPress and PrestaShop sites in September, roughly a sevenfold increase in four months. Scale is not the real story though. The story is that a campaign this size ran on free testnet tokens and a piece of JavaScript, and the defender's usual first move, calling the host, has no counterpart here.

Expect the technique to migrate. Nothing about EtherHiding is specific to BNB Smart Chain, and any chain with cheap or free writes and a public RPC endpoint works identically. The controls that survive that migration are the ones on the endpoint, not the ones on the network, which is an uncomfortable conclusion for anyone whose user awareness program still teaches people to check the sender before opening the attachment. There is no attachment. There is a person, a keyboard, and a box that should not be there.