Thousands of Websites Serve Blockchain-Hosted ClickFix Payloads
A pervasive cybercriminal operation has compromised over 5,400 small-business websites, primarily built on WordPress and PrestaShop, to deliver malicious payloads hosted on the BNB Smart Chain (BSC) Testnet. This campaign leverages a technique known as EtherHiding, where threat actors store dynamic malicious code within blockchain smart contracts, creating a resilient and difficult-to-disrupt infrastructure for their operations.
Researchers at cloud security platform Netskope identified a significant increase in compromised sites contacting BSC Testnet RPC endpoints since spring, with daily numbers reaching nearly 400 in August and peaking at 536. This ongoing threat underscores the evolving tactics of cybercriminals who exploit decentralized technologies for command and control.
Technical Details of EtherHiding and ClickFix Payload Delivery via Blockchain
The initial method of website compromise remains unspecified by researchers. However, once compromised, each site is injected with a script designed to fetch its next-stage payload from a smart contract residing on the BSC Testnet. The BSC Testnet, intended for developers, mimics the functionality of the main production blockchain but is accessible without cost. This characteristic makes it an attractive platform for threat actors seeking free and highly available infrastructure.
Threat actors exploit the EtherHiding technique by storing configuration data or malicious code directly within these smart contracts. This approach grants them the ability to modify payloads at any time, adapting their attacks dynamically and making takedown efforts challenging due to the decentralized nature of blockchain. The campaign has demonstrated this adaptability through its payload evolution.
Initially, the injected script displayed a ClickFix lure, presenting visitors with a fake CAPTCHA. Users were then instructed to open the Windows Run dialog and paste a PowerShell command. Executing this command would download and execute the final malicious payload directly onto the victim’s machine, potentially leading to remote code execution and system compromise.
Evolution to WebRTC Data-Channel Stagers
Later in the campaign, the threat actor updated the smart contract to deliver a more sophisticated WebRTC data-channel stager. This newer variant establishes a covert, encrypted communication channel to the attacker’s infrastructure. Netskope explains that this stager creates a peer connection and a data channel, generating a session description offer like a standard WebRTC handshake. However, instead of awaiting a legitimate reply, it “hand-writes the answer itself” and feeds it back into the connection. This circumvents a typical handshake while still establishing a data channel to the cyberattacker.
The stager then receives JavaScript code from a hardcoded command-and-control (C2) address. This code is buffered, assembled in the browser memory, and executed dynamically when the channel closes or after ten seconds, without being saved to the victim’s disk. This fileless execution makes detect EtherHiding attacks and subsequent compromise more difficult for traditional endpoint detection solutions.
Actionable Recommendations for Mitigating WebRTC Data-Channel Stagers
Organizations and website administrators must prioritize defensive measures to counter this threat. Netskope specifically recommends blocking the entire pool of BSC Testnet RPC endpoints. This action will prevent compromised sites from fetching malicious payloads stored on the blockchain.
Furthermore, security teams should focus on monitoring network traffic for indicators of compromise related to the WebRTC stager. Specifically, mitigating WebRTC data-channel stagers involves looking for non-web User Datagram Protocol (UDP) traffic associated with WebRTC, which could indicate covert communication channels. Given that attackers are actively using valid credentials post-initial access, general prevention scores might obscure the true extent of risk. Implementing strong post-initial access defenses, regular patching of web platforms like WordPress and PrestaShop, and continuous security monitoring are crucial to protect against such resilient and adaptive threats.
Related: Node.js Abuse: Attackers Deploy Malware via Trusted Runtime, ClickFix Campaign Exploits Polygon Blockchain for C2 Evasion