← News
/DISPATCH · 2026-09-14

EtherHiding+ClickFix Mass Delivery: 5,400 SMB Sites Implanted with Blockchain Payloads

Netskope Threat Labs reports more than 5,400 SMB websites compromised and used to deliver ClickFix payloads. Malicious configuration is stored in BNB Smart Chain contracts. A new variant uses WebRTC data channels for encrypted covert C2 with almost no disk artifacts.

Netskope Threat Labs disclosed a large-scale delivery campaign: more than 5,400 SMB websites were compromised and used to push ClickFix lures to visitors. Malicious configuration is stored in smart contracts on BNB Smart Chain. More than 2,200 organizations were affected—clinics, repair shops, online stores, and other small sites. Most run WordPress; some run PrestaShop. Researchers have not confirmed the initial intrusion method. Visiting a real, normally trusted company site can still produce a malicious popup.

Incident Overview

The campaign combines two existing techniques. EtherHiding conceals: payload addresses and configuration are written into blockchain smart contracts and read at runtime by injected page scripts. Attackers no longer hardcode domains or IPs, so static analysis and domain blocking cannot cut the channel. ClickFix deceives: it forges an ordinary CAPTCHA prompt telling the user to open the Windows Run dialog and paste a command. Netskope monitoring shows high density—hundreds of compromised sites active daily, and more than 300 sites talking to malicious infrastructure on recent weekdays.

Technical Details

Compromised pages contain obfuscated scripts that issue read-only queries to a smart contract and retrieve the latest delivery domain. Attackers switch infrastructure by updating contract contents; infected site code needs no change. Traditional blacklist blocking is nearly useless. The current version uses a BNB Smart Chain testnet contract—low cost and hard to take down.

The lure reuses the ClickFix template: after load, the background blurs and a verification dialog appears, instructing the user to copy a command and paste it into the Run dialog. The command hits a remote WebDAV path and loads a DLL disguised as a normal file. 32-bit `rundll32.exe` invokes it by export ordinal, then decrypts a memory-resident infostealer. Researchers also recorded a new variant that drops social engineering: it abuses WebRTC, tampers with handshake logic, skips the signaling server, and builds an encrypted UDP covert channel. Code runs only in memory and reuses an existing page nonce to bypass CSP. Both paths have been observed in live traffic.

Impact Assessment

The campaign targets quickly monetizable credentials and digital assets, not enterprise intranet destruction. Victims often notice only after funds are stolen. Payload configuration contains hundreds of collection rules covering browsers, extensions, IM, crypto wallets, password managers, authenticators, mail clients, and remote-access tools. It searches common directories for private keys, wallet backups, API and OAuth credentials, and certificate files. For SMBs the risk is dual: a compromised site damages brand and visitor safety, and visitors facing a fake verification dialog on a real site have a lower psychological barrier than on a stranger site.

Remediation

References