- The Mess: More than 5,400 compromised websites are being used to deliver ClickFix malware, with the next-stage payload stored inside smart contracts on the BNB Smart Chain.
Most of the hacked sites are small-business websites running WordPress or PrestaShop.
The attackers inject malicious JavaScript into the sites. That script doesn’t need to contact a traditional malware server for instructions.
Instead, it queries a smart contract on the BNB Smart Chain Testnet.
The technique is known as EtherHiding.
The blockchain becomes the attacker’s infrastructure.
- The Damage: Visitors see a fake CAPTCHA and are told to open Windows Run and paste a command. If they follow the instructions, they execute the attack themselves.
That’s what makes ClickFix so effective.
No exploit is required.
The victim runs the command.
Researchers also observed the campaign evolving beyond the original ClickFix chain. A newer variant uses a WebRTC data-channel stager to receive and execute attacker-controlled JavaScript directly in the browser.
Because the payload can be changed inside the smart contract, attackers can update the campaign without returning to all 5,400 compromised websites.
The campaign remains active at scale. Netskope observed more than 300 infected websites per day, with nearly 400 sites contacting the BSC Testnet endpoint daily during August and a peak of 536.
- The Fix: Website owners should investigate unexpected JavaScript injections, while defenders should monitor for suspicious BSC Testnet RPC traffic and unusual WebRTC activity.
For users, the rule is much simpler:
A CAPTCHA should never ask you to open Windows Run, PowerShell or Terminal.
If a website tells you to copy and paste a command to prove you’re human, you’re not proving anything.
You’re running malware.
Bugstoday’s Opinion
Attackers used to need bulletproof hosting.
Now they can hide part of their infrastructure in a blockchain.
That’s the clever part.
The hacked website becomes disposable.
The smart contract remains the delivery point.
And the victim does the final execution manually.
This is why ClickFix keeps spreading. It bypasses the oldest security control on the Internet:
common sense.
The fake CAPTCHA doesn’t exploit Windows.
It exploits the person sitting in front of it.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Netskope Threat Research
- BleepingComputer — Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain
