Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain
Thousands of hacked websites are serving ClickFix malware payloads stored on the blockchain.
A large cybercriminal operation is using over 5,400 compromised websites, primarily WordPress and PrestaShop, to distribute ClickFix malware. The payloads are stored in smart contracts on the BNB Smart Chain (BSC) Testnet, a technique called EtherHiding, making the infrastructure resilient. The malware lures victims with a fake CAPTCHA, prompting them to run a PowerShell command that downloads the final payload. Later variants replaced ClickFix with a WebRTC stager for covert, encrypted communication.
AI summary of the linked source. Not reviewed by an editor. How this works
Run WordPress?
Get an email when a new story names WordPress, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers compromised over 5,400 WordPress and PrestaShop sites — likely through unpatched plugins, weak credentials, or misconfigured admin panels — and injected malicious scripts that redirect visitors to fake CAPTCHA pages. The 'EtherHiding' technique stores malware payloads in BNB Smart Chain smart contracts, making traditional domain takedowns ineffective since the blockchain infrastructure cannot be simply seized or blocked. Victims are socially engineered into executing a malicious PowerShell command, bypassing endpoint defenses by abusing a trusted OS tool. This campaign highlights how attackers are chaining website compromise, decentralized infrastructure, and user manipulation to create highly resilient attack chains that evade conventional security controls.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — bsc.testnet.rpc.com
- malware — ClickFix
- malware — WebRTC data-channel stager