Blockchain as Bulletproof Hosting
Researchers at Netskope have identified a large-scale campaign abusing a technique called EtherHiding — storing malicious payload code inside smart contracts on the BNB Smart Chain (BSC) Testnet — to run a resilient, takedown-resistant ClickFix operation across thousands of compromised websites.
By the Numbers
| Metric | Detail |
|---|---|
| Compromised sites identified | 5,400+ |
| Platforms affected | Primarily WordPress and PrestaShop |
| Daily active infections | 300+ sites contacting the infrastructure |
| Peak daily contacts (August) | 536 |
| Payload storage | Smart contracts on BNB Smart Chain Testnet |
| Discovered by | Netskope Threat Labs |
Why the Blockchain Matters Here
Traditional malware C2 infrastructure — domains, IPs, hosting accounts — can be seized, sinkholed, or taken down by registrars, hosting providers, and law enforcement. Smart contracts deployed to a public blockchain don't have that single point of failure: once written, the contract's data persists on every node in the network, and there's no central registrar to serve a takedown notice.
By injecting scripts into compromised WordPress and PrestaShop sites that fetch their next-stage payload directly from a BSC smart contract, the operators get infrastructure that's cheap to redeploy, effectively free to keep online, and far harder for defenders to disrupt than a conventional C2 domain.
Attack Chain
1. Attacker compromises a WordPress or PrestaShop site (exact initial-access
vector not detailed by researchers — consistent with known plugin/theme
exploitation or credential reuse)
2. Injected script on the compromised site queries a BSC smart contract
for the current payload
3. Visitor sees a fake CAPTCHA / security-verification prompt (ClickFix lure)
4. Prompt instructs the visitor to open the Windows Run dialog and paste
a provided command
5. Pasted PowerShell command downloads and executes the actual payload
6. Later-stage variants switch to a WebRTC data-channel stager, running
dynamically generated JavaScript in browser memory with no disk artifactThe WebRTC evolution is notable: because the stager executes in memory via an encrypted peer-to-peer data channel rather than writing files to disk, it sidesteps a lot of file-based detection and blends with legitimate real-time-communication traffic.
Detection and Defense
For Site Operators
- Audit theme and plugin code for injected scripts referencing blockchain RPC endpoints or unfamiliar third-party domains
- Keep WordPress/PrestaShop core, plugins, and themes patched — compromised CMS installs are the entry point for this campaign
- Monitor outbound connections from web servers to blockchain RPC endpoints, which legitimate CMS operation has no reason to make
For Endpoint Defenders
- Block BSC Testnet RPC endpoints at the network egress level where there's no legitimate business use for blockchain connectivity
- Train users to recognize ClickFix lures — no legitimate CAPTCHA or verification flow ever asks a user to paste commands into the Run dialog
- Monitor for anomalous WebRTC/UDP traffic unrelated to known video/voice applications
- Alert on PowerShell processes spawned from browser child processes