A large-scale cybercriminal operation has compromised over 5,400 small-business websites to distribute ClickFix payloads. The payloads are stored in smart contracts on the BNB Smart Chain (BSC), leveraging blockchain infrastructure to evade takedowns. Victims visiting the compromised sites are served malicious content that attempts to trick them into executing commands or downloading malware. The use of blockchain-based smart contracts for payload storage represents an evasion technique making it difficult for defenders to remove malicious content. This campaign highlights the growing abuse of decentralized technologies for malware distribution. The scale of the operation—thousands of hacked sites—indicates a well-resourced and organized threat actor. ClickFix is a social engineering technique that instructs users to manually run malicious commands under the guise of fixing an error or CAPTCHA.
A large-scale cybercriminal operation has compromised over 5,400 small-business websites (primarily WordPress and PrestaShop) by injecting malicious scripts that leverage the EtherHiding technique. The injected scripts retrieve next-stage payloads from smart contracts hosted on the BNB Smart Chain (BSC) Testnet, which provides free and resilient infrastructure difficult to take down. The attack chain presents victims with a ClickFix lure displaying a fake CAPTCHA that instructs users to open the Windows Run dialog and paste a PowerShell command, which downloads and executes the final payload. Because the payload is stored in a smart contract, the attacker can modify it at any time. In a later campaign variant, the ClickFix payload was replaced with a WebRTC data-channel stager. This stager creates a peer connection and data channel, generates a session description offer, and self-answers the handshake without a real reply, establishing a covert encrypted channel to the attacker's C2. Received JavaScript code is buffered and executed dynamically in browser memory (added to the DOM head) without being written to disk. The operation uses more than 300 infected websites daily, with telemetry showing nearly 400 websites calling BSC Testnet RPC endpoints per day in August, peaking at 536.
1. Block the entire pool of BSC Testnet RPC endpoints as listed in the Netskope IOC repository: https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Malware/Amatera%20ClickFix. 2. Monitor for non-web UDP traffic associated with WebRTC data channels, which may indicate covert C2 communication. 3. Audit WordPress and PrestaShop sites for injected scripts that contact blockchain RPC endpoints. 4. Educate users not to follow instructions from browser-based CAPTCHA prompts that ask them to open the Windows Run dialog or paste PowerShell commands. 5. Monitor endpoints for suspicious PowerShell execution originating from browser activity. 6. Implement web filtering to block access to known BSC Testnet RPC endpoints at the network perimeter.
BSC Testnet RPC endpoints (full list: https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Malware/Amatera%20ClickFix), Non-web UDP traffic associated with WebRTC data channels, PowerShell commands triggered via Windows Run dialog from browser CAPTCHA lures, Scripts contacting BSC Testnet RPC endpoints from compromised websites
