More than 5,400 hacked websites have been used to distribute ClickFix malware, with cybercriminals hiding parts of the attack infrastructure in smart contracts on the BNB Smart Chain.
The compromised sites are largely small-business websites running WordPress or PrestaShop. Researchers at cloud security firm Netskope said the campaign has been active for months, although the method used to gain access to the sites remains unknown.
Once a website is breached, attackers inject a script that contacts a remote procedure call endpoint on the BNB Smart Chain Testnet. The blockchain-based technique, known as EtherHiding, allows malicious code or configuration data to be stored in smart contracts rather than on conventional servers.
The testnet is intended for software developers and operates in a similar way to the main BNB Smart Chain network, but is available without charge. Using it gives attackers infrastructure that can be difficult to disrupt, while allowing them to alter the stored payload without modifying every compromised website.
Fake CAPTCHA directs visitors to PowerShell command
Visitors to infected sites are shown a fake CAPTCHA or similar verification screen. The ClickFix lure then instructs them to open the Windows Run dialogue and paste a PowerShell command.
Following those directions downloads and runs the next-stage malware on the computer. The approach relies on persuading users to carry out an action themselves, rather than exploiting a technical vulnerability in the browser.
Netskope said the attackers later replaced the ClickFix payload held in the smart contract with a stager that uses WebRTC, a technology commonly associated with real-time browser communications.
The newer version creates a WebRTC peer connection and data channel, but fabricates the response required to complete the connection instead of communicating with a legitimate remote peer. This enables the malware to establish an encrypted channel with the attacker and receive further JavaScript code.
The code is held in the browser’s memory and executed dynamically. It is not written to disk, making the activity harder to detect using security tools that focus on saved files.
Netskope said the stager retrieves code from a hardcoded command-and-control address, stores it temporarily and executes it when the channel closes or after 10 seconds.
Compromised website activity continues to rise
The researchers said more than 300 infected websites were being used each day in the operation. Their telemetry showed that almost 400 sites contacted the BNB Smart Chain Testnet endpoints daily in August, with a peak of 536.
The number of compromised websites communicating with the blockchain infrastructure has continued to increase since the spring, according to Netskope.
Security teams have been advised to block the pool of BNB Smart Chain Testnet RPC endpoints associated with the campaign and monitor for unexpected non-web UDP traffic linked to WebRTC.
