[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKWCZ44bBfTcktO9k0opHEOOkNKjRwF4tTuiLN3mknF0":3},{"article":4,"iocs":49,"watch_terms":60,"solutions":61,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"9adc0e18-5a1e-4847-b31a-416e72bbd70d","Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain","over-5-400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain-1305dd","A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC). [...]","A large cybercriminal operation is using over 5,400 compromised websites, primarily WordPress and PrestaShop, to distribute ClickFix malware. The payloads are stored in smart contracts on the BNB Smart Chain (BSC) Testnet, a technique called EtherHiding, making the infrastructure resilient. The malware lures victims with a fake CAPTCHA, prompting them to run a PowerShell command that downloads the final payload. Later variants replaced ClickFix with a WebRTC stager for covert, encrypted communication.","Thousands of hacked websites are serving ClickFix malware payloads stored on the blockchain.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fover-5-400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F03\u002F18\u002FBlockchain.jpg","2026-09-05T14:29:13+00:00","2026-09-05T16:00:14.753378+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"WordPress","product",{"name":21,"type":19},"PrestaShop",{"name":23,"type":24},"BNB Smart Chain","technology",{"name":26,"type":24},"smart contracts",{"name":28,"type":24},"WebRTC",{"name":30,"type":24},"PowerShell","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,57],{"type":51,"value":52,"context":53},"domain","bsc.testnet.rpc.com","BNB Smart Chain Testnet RPC endpoint used for payload delivery",{"type":35,"value":55,"context":56},"ClickFix","Malware name observed in the campaign",{"type":35,"value":58,"context":59},"WebRTC data-channel stager","Later variant payload used for covert communication",[18,21],{"controls":62,"vendors":146},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":93,"name":94,"problem":95,"products":96},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":122,"name":123,"problem":124,"products":125},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[126,133,139],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":130,"url":131,"description":132},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":134,"product_name":135,"url":137,"description":138},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":122,"product_name":143,"url":144,"description":145},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":170},"blockchain-hosted-clickfix-malware-hijacks-5400-websites","Blockchain-Hosted ClickFix Malware Hijacks 5,400+ Websites","Attackers compromised over 5,400 WordPress and PrestaShop sites — likely through unpatched plugins, weak credentials, or misconfigured admin panels — and injected malicious scripts that redirect visitors to fake CAPTCHA pages. The 'EtherHiding' technique stores malware payloads in BNB Smart Chain smart contracts, making traditional domain takedowns ineffective since the blockchain infrastructure cannot be simply seized or blocked. Victims are socially engineered into executing a malicious PowerShell command, bypassing endpoint defenses by abusing a trusted OS tool. This campaign highlights how attackers are chaining website compromise, decentralized infrastructure, and user manipulation to create highly resilient attack chains that evade conventional security controls.",[158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 9: Email and Web Browser Protections","CIS Control 16: Application Software Security","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST CSF DE.CM-4: Malicious code detection","OWASP Top 10 A05: Security Misconfiguration","OWASP Top 10 A06: Vulnerable and Outdated Components","GDPR Article 32: Security of Processing (for EU site operators hosting user data)",{}]