Cybercriminals Use Blockchain Smart Contracts to Run ClickFix Malware Campaign Across 5,400+ Hacked Websites
Security researchers at Netskope have identified a large-scale cybercriminal operation that has compromised more than 5,400 small-business websites, most built on WordPress and PrestaShop, to distribute malware through fake CAPTCHA prompts. The campaign relies on “ClickFix” social-engineering lures that trick visitors into opening the Windows Run dialog and pasting a malicious PowerShell command, which then downloads and executes malware on the victim’s machine. How the sites were initially compromised remains unknown, but each was injected with a script pulling instructions from outside infrastructure.
What distinguishes this campaign is where that infrastructure lives: rather than relying on servers that can be seized or blacklisted, the attackers store their malicious payloads inside smart contracts on the BNB Smart Chain’s free public testnet, a technique known as EtherHiding. Because blockchain records are decentralized and difficult to take down, attackers can update the payload at will while evading traditional infrastructure-blocking defenses. Telemetry reviewed by researchers showed the campaign growing steadily since spring, with more than 300 infected websites contacting the blockchain-hosted payload daily and a recorded peak of 536 sites in a single day.
Netskope also observed the operation evolving mid-campaign: in a later variant, attackers replaced the original ClickFix payload with a stager that opens a covert, encrypted WebRTC data channel to a hardcoded command-and-control address, allowing malicious code to be fetched and run entirely in browser memory without ever touching disk. Researchers recommend that defenders block known BNB Smart Chain testnet endpoints and monitor for unusual WebRTC-related network traffic, though the use of public blockchain infrastructure as resilient malware hosting is likely to make this and similar campaigns harder to disrupt going forward.