A large-scale malware operation is using thousands of compromised websites to distribute ClickFix blockchain payloads through smart contracts on the BNB Smart Chain Testnet.
Researchers have identified more than 5,400 hacked websites, mainly WordPress and PrestaShop sites. The attackers injected malicious scripts into the sites, although the initial access method remains unknown.
The scripts retrieve second-stage payloads from smart contracts hosted on BSC Testnet infrastructure. This approach, known as EtherHiding, gives attackers a resilient delivery system that is difficult to remove.
Smart contracts conceal malicious payloads
BSC Testnet is a free blockchain environment intended for developers. It works similarly to the production BNB Smart Chain but does not require attackers to pay mainnet transaction fees.
Threat actors can store malicious code or configuration data in smart contracts. As a result, they can update the content without changing the compromised websites that load it.
This model makes takedowns harder. Even if defenders identify an infected site, the attacker can alter the next-stage payload through the blockchain contract.
Researchers said the number of compromised websites contacting BSC Testnet endpoints has steadily increased since spring.
Fake CAPTCHA lures victims into running PowerShell
The malicious script displays a ClickFix lure that resembles a CAPTCHA verification prompt. It tells visitors to open the Windows Run dialog and paste a PowerShell command.
If a victim follows the instructions, the command downloads and executes the final payload. ClickFix campaigns rely on social engineering rather than exploiting a browser vulnerability directly.
The attackers can replace their payload at any time because the website retrieves it from the smart contract. Researchers observed the group switch from a ClickFix payload to a WebRTC data-channel stager later in the campaign.
WebRTC stager creates a covert channel
The newer payload creates a WebRTC peer connection and data channel. However, it does not complete a normal exchange with another endpoint.
Instead, the malware generates its own session description offer and manually creates the corresponding answer. This process allows it to open a covert encrypted channel to attacker-controlled infrastructure.
The stager then receives JavaScript from a hardcoded command-and-control address. It stores the code in browser memory and executes it dynamically after the data channel closes or after ten seconds.
Because the code never needs to be written to disk, the technique may reduce the chance of detection by traditional endpoint tools.
Hundreds of infected sites are active each day
Researchers said the operation uses more than 300 infected websites every day. In August, almost 400 sites contacted BSC Testnet RPC endpoints daily.
The activity reached a peak of 536 websites in a single day. Those figures show that ClickFix blockchain payloads are being distributed through a broad and active network of compromised sites.
Defenders should block known BSC Testnet RPC endpoints and investigate unexpected WebRTC-related UDP traffic from devices that do not normally use it.
Users should also treat CAPTCHA prompts that ask them to run commands as malicious. Legitimate websites never require visitors to open Windows Run and paste PowerShell instructions to prove they are human.
0 responses to “Over 5,400 Hacked Sites Deliver ClickFix Blockchain Payloads”