Full Report
A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC). [...]
Analysis Summary
# Incident Report: EtherHiding & ClickFix Blockchain Campaign
## Executive Summary
A large-scale cybercriminal operation has compromised over 5,400 small-business websites (primarily WordPress and PrestaShop) to deliver "ClickFix" malware via the BNB Smart Chain (BSC). By using the "EtherHiding" technique, attackers host malicious payloads within blockchain smart contracts to ensure infrastructure resilience. The campaign recently evolved to use WebRTC data channels for stealthy, encrypted command execution directly in the browser memory.
## Incident Details
- **Discovery Date:** September 5, 2026 (Reported)
- **Incident Date:** Ongoing since Spring 2026; peaked in August 2026
- **Affected Organization:** 5,400+ small-business entities
- **Sector:** Various (Small Business, E-commerce)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Spring 2026 – Ongoing
- **Vector:** Unknown (Likely exploitation of vulnerabilities in WordPress/PrestaShop plugins or themes)
- **Details:** Thousands of sites were injected with a malicious script designed to call blockchain endpoints.
### Lateral Movement
- **Details:** Not applicable at the web-layer; the attack focuses on client-side execution (victim's machine) rather than lateral movement within the compromised web server’s internal network.
### Data Exfiltration/Impact
- **Details:** Delivery of ClickFix lures (social engineering) leading to the execution of PowerShell scripts. Later variants used WebRTC to establish covert channels for dynamic code execution and potential data theft.
### Detection & Response
- **Detection:** Identified by Netskope researchers monitoring traffic to BSC Testnet RPC endpoints.
- **Response:** Public disclosure of Indicators of Compromise (IoCs) and recommendation to block BSC Testnet RPC endpoints.
## Attack Methodology
- **Initial Access:** Compromise of WordPress/PrestaShop sites.
- **Persistence:** Use of decentralized blockchain smart contracts (EtherHiding) for resilient payload hosting.
- **Defense Evasion:** Use of WebRTC data channels to bypass traditional firewalls; dynamic execution of code in browser memory (DOM) without saving to disk.
- **Credential Access:** Social engineering via fake CAPTCHA (ClickFix) to trick users into running PowerShell commands.
- **Discovery:** N/A
- **Lateral Movement:** N/A
- **Collection:** Data gathered via encrypted WebRTC channels.
- **Exfiltration:** Covert encrypted channels to attacker-controlled C2.
- **Impact:** Complete compromise of the visiting user’s endpoint via remote code execution.
## Impact Assessment
- **Financial:** Unknown; potential for ransomware or banking trojan delivery.
- **Data Breach:** Potential for theft of user credentials and sensitive session data from thousands of visiting users.
- **Operational:** 5,400+ websites serving malware, leading to blacklisting by search engines.
- **Reputational:** Significant damage to small businesses whose sites are being used to infect their customers.
## Indicators of Compromise
- **Network Indicators:**
- Traffic to BSC Testnet RPC endpoints (e.g., `https[:]//data-seed-prebsc-1-s1[.]binance[.]org[:]8545/`)
- Non-web UDP traffic associated with anomalous WebRTC handshakes.
- **File/Script Indicators:**
- Malicious scripts injected into WordPress/PrestaShop headers/footers.
- PowerShell commands involving `powershell -ExecutionPolicy Bypass -WindowStyle Hidden`.
- **Behavioral Indicators:**
- Fake CAPTCHA pop-ups requesting users to press `Win+R` and paste text.
## Response Actions
- **Containment:** Blocking access to known BSC Testnet RPC endpoints at the enterprise gateway.
- **Eradication:** Web administrators must clean injected scripts from site databases and update CMS platforms.
- **Recovery:** Rotating administrative credentials and patching vulnerabilities in WordPress/PrestaShop.
## Lessons Learned
- **Decentralized Threats:** Blockchain provides a "bulletproof" hosting environment for attackers that cannot be taken down via traditional domain/IP seizure.
- **Social Engineering Efficacy:** ClickFix lures effectively bypass technical controls by tricking users into manually executing commands.
- **Living-off-the-Browser:** The shift to WebRTC-based stagers shows attackers are moving toward memory-only, encrypted execution to evade EDR and network inspection.
## Recommendations
- **Web Admins:** Implement File Integrity Monitoring (FIM) on CMS platforms and enforce Multi-Factor Authentication (MFA).
- **Network Defense:** Block all BSC (Binance Smart Chain) Testnet RPC endpoints if there is no legitimate business need for blockchain development.
- **User Training:** Educate employees to never copy-paste commands into the Windows Run dialog or PowerShell prompts from website pop-ups.