5,400 hacked sites deliver ClickFix malware via blockchain smart contracts

More than 5,400 compromised websites — most built on WordPress and PrestaShop — are being used in an active malware campaign that stores its payloads inside blockchain smart contracts, researchers at Netskope revealed this week. The technique makes takedowns nearly impossible: there is no central server to seize.

How the attack works

Each infected site carries an injected script that reaches out to the BNB Smart Chain Testnet — the developer sandbox version of Binance's blockchain — and pulls down a malicious payload from a smart contract stored there. This approach, known as EtherHiding, was first documented in 2023 but has now scaled to an operation running on hundreds of sites every single day, with a peak of 536 sites contacting the BSC Testnet in a single day during August 2026.

The user-facing lure is a ClickFix attack: victims see a fake CAPTCHA page that instructs them to open the Windows Run dialog and paste a PowerShell command. Doing so executes the payload, which was silently fetched from the blockchain moments before. Because the payload lives in a smart contract, the attacker can swap it at any time without touching the compromised websites.

The WebRTC twist

Later in the campaign, Netskope observed the threat actor replacing the ClickFix payload in the smart contract with a significantly more sophisticated stager using WebRTC data channels. Instead of connecting to a command-and-control server in the conventional sense, the stager performs a fake WebRTC handshake with itself — generating a session description offer and immediately feeding the answer back without any external server involvement. This opens an encrypted covert channel to the attacker's hardcoded address.

Received JavaScript code is assembled in browser memory and executed without being written to disk, making it difficult for endpoint detection tools to catch. The stager executes its received payload after ten seconds or when the data channel closes, whichever comes first.

Why blockchain-hosted malware is hard to stop

Traditional malware infrastructure depends on servers that defenders can identify, block, and seize. A payload stored in a blockchain smart contract has none of those weaknesses. The BNB Smart Chain Testnet is designed for developers, runs free of charge, and is replicated across thousands of nodes globally — making it censorship-resistant by design.

The initial infection vector for the 5,400 compromised websites is still unknown, but the campaign has been running since at least spring 2026 and continues to grow. Netskope's telemetry shows the number of compromised sites contacting BSC Testnet endpoints has grown consistently month over month.

How to defend against it

Netskope recommends that network defenders block the entire pool of BSC Testnet RPC endpoints — a full indicator-of-compromise list is available in the company's public GitHub repository. Security teams should also monitor for non-web UDP traffic, which the WebRTC stager variant generates. As reported by BleepingComputer.