A ClickFix EtherHiding blockchain attack has compromised more than 5,400 websites and is actively delivering malicious payloads stored inside smart contracts on the BNB Smart Chain (BSC), according to researchers at cloud security platform Netskope. The scale is broader than the raw site count suggests: those compromised properties span more than 2,200 organisations worldwide.
Most of the affected sites are built on WordPress and PrestaShop. The initial compromise method remains unknown in each case, but once attackers are in, they inject a script that fetches the next-stage payload directly from a smart contract hosted on the BSC Testnet endpoint. Netskope notes the BSC Testnet is designed for developers and functions similarly to the mainnet production blockchain, but is available free of charge, making it a convenient and resilient staging ground for malicious infrastructure.
Why the ClickFix EtherHiding Blockchain Attack Is Hard to Dismantle
The technique at the heart of this campaign, known as EtherHiding, is not new. According to Trend Micro, it was first documented by Guardz in October 2023. The core idea is straightforward: store malicious code or configuration data inside blockchain smart contracts, which are effectively immutable from the perspective of any takedown request. You cannot phone the blockchain and ask it to pull a contract. That resilience is precisely what makes the infrastructure attractive to threat actors, and the current campaign illustrates how the approach has matured since it was first observed.
In the delivery chain Netskope observed, the injected script presents visitors with a ClickFix lure: a fake CAPTCHA page that instructs the user to open the Windows Run dialog and paste in a PowerShell command. Complying downloads and executes the final payload on the machine. Because the payload lives in a smart contract rather than on a conventional server, the attacker can swap it out at any time without touching the compromised sites themselves.
That flexibility has already been used. Later in the campaign, the threat actor replaced the ClickFix payload in the smart contract with a WebRTC data-channel stager. The shift is worth understanding in detail, because it represents a meaningful escalation in operational sophistication.
The WebRTC Variant: a Covert Channel That Skips the Handshake
In the newer variant, the payload establishes an encrypted covert channel between the victim’s browser and the attacker’s infrastructure. Netskope describes the mechanics precisely: ‘The script creates a peer connection and a data channel, then generates the required session description offer just like a normal WebRTC handshake. But instead of sending that offer anywhere and waiting for a real reply, it hand-writes the answer itself and feeds it straight back into the connection. This way, no handshake happens, but a data channel to the cyberattacker still opens.’
The stager then receives JavaScript code from a hardcoded command-and-control (C2) address, buffers it, and executes it either when the channel closes or after ten seconds, whichever comes first. Crucially, the received code is assembled in browser memory and executed dynamically by being added to the head of the Document Object Model (DOM), meaning it is never written to disk. That characteristic makes it considerably harder for endpoint detection tools to catch.
The operational tempo is high. Netskope warns that the campaign uses more than 300 infected websites every day. Since spring, the number of compromised sites contacting BSC Testnet RPC endpoints has grown steadily. Telemetry shows nearly 400 websites called the endpoint daily in August, with an all-time peak of 536 on a single day, as G-Block reported on 5 September 2026.
For defenders, Netskope’s recommendations are concrete. Block the entire pool of BSC Testnet RPC endpoints (Netskope provides the full list in its research). Monitor for non-web UDP traffic associated with WebRTC, which the stager relies on to open its covert channel. Both measures target the infrastructure the campaign depends on, rather than trying to chase individual payloads that the attacker can rotate at will from inside the blockchain.
The campaign also underscores a broader detection gap. Netskope notes that once attackers are operating with valid credentials, only 37% of their subsequent actions are blocked by typical defences, a reminder that preventing initial access is not the only metric worth watching.
