Researchers at Netskope have uncovered a large-scale malware delivery campaign that takes two well-known tricks — ClickFix social engineering and blockchain-based payload hosting — and combines them into an infrastructure that is remarkably difficult to shut down. More than 5,400 compromised websites, most running WordPress or PrestaShop, have been injected with a script that fetches its next-stage payload from a smart contract on the BNB Smart Chain (Binance’s blockchain), a technique known as EtherHiding. Because the payload lives inside a blockchain smart contract, attackers can silently swap out the malware at any time without touching any of the 5,400 infected sites, and no traditional hosting provider can take it down.
When a visitor lands on one of the compromised pages, the injected script displays a fake CAPTCHA with a ClickFix-style message telling them to open the Windows Run dialog and paste in a PowerShell command. Following those instructions downloads and runs the attacker’s current payload — whatever they have placed in the smart contract at that moment. Netskope observed the attackers later updating the smart contract to deliver a more sophisticated WebRTC stager: instead of a simple file download, this variant secretly establishes a live encrypted channel back to the attacker’s server, assembles and runs received code entirely in the browser’s memory without touching the disk, and terminates cleanly once the code executes. The operation spans more than 300 command-and-control infrastructure components.
How to check if you’re affected
Affected devices are any Windows computers whose users were prompted by an unfamiliar website to open the Windows Run dialog (Win+R) and paste a command. If you followed such a prompt in the last several months, run a full antivirus scan immediately. Legitimate websites never ask you to paste commands into Run or PowerShell — any site that does is attempting to compromise your machine. If you are a website operator on WordPress or PrestaShop, check your site’s HTML for injected <script> tags loading external JavaScript, especially those making calls to BNB Smart Chain RPC endpoints.