Thousands of Compromised Websites Used to Deliver Blockchain-Hosted ClickFix Malware

Security researchers have identified a large-scale campaign in which more than 5,400 compromised websites are being used to deliver ClickFix social-engineering attacks. The affected sites are primarily small-business websites running WordPress and PrestaShop, according to findings from Netskope.

Attackers injected malicious scripts into the sites, although the initial access method has not been established. Rather than hosting all malicious content on conventional attacker-controlled servers, the injected code retrieves follow-on instructions from smart contracts on the BNB Smart Chain test network. This approach, often called EtherHiding, can make malicious infrastructure more resilient because blockchain-hosted content is harder to remove or disrupt than a typical web server.

Fake CAPTCHA prompts lead to PowerShell execution

Visitors to infected sites may be shown a fraudulent CAPTCHA-style verification prompt. The page instructs users to open the Windows Run dialog and paste a supplied command, a tactic commonly associated with ClickFix attacks. If followed, the instruction launches PowerShell and downloads or executes additional malware.

The use of a smart contract also gives operators flexibility to alter the payload without reinfecting the websites. Researchers said the campaign later shifted from a direct ClickFix payload to a WebRTC-based stager.

In that version, browser code creates an encrypted WebRTC data channel that communicates with attacker infrastructure. The stager collects JavaScript received through the channel and runs it dynamically in the browser's memory. This can reduce visible artifacts because the delivered code does not need to be written to disk before execution.

Activity remained sustained

Netskope reported that the operation has relied on more than 300 compromised sites per day. The number of infected websites contacting BNB Smart Chain testnet remote procedure call endpoints rose over recent months, with daily activity reaching nearly 400 sites in August and peaking at 536 sites.

• Organizations should consider blocking BNB Smart Chain testnet RPC endpoints where business requirements allow.
• Security teams should monitor for unusual WebRTC-related UDP traffic and browser activity.
• Users should be trained that legitimate CAPTCHA checks do not require opening Run, PowerShell, or Terminal and pasting commands.
• Website operators should review sites for unauthorized scripts and promptly apply CMS, plugin, and theme updates.