EtherHiding ClickFix campaign hits 5,400 hacked small-business sites

Netskope Threat Labs says more than 5,400 compromised websites are pulling malicious payloads from a smart contract on the BNB Smart Chain (BSC) testnet. The campaign spans over 2,200 organizations worldwide and it's still growing. Most of the hacked sites belong to small businesses: clinics, plumbers, small e-commerce shops.

EtherHiding is a technique that stores malicious code or configuration data inside blockchain smart contracts, so the payload host can't be seized or pulled offline. Netskope's September 3, 2026 write-up by John Carlo Marquez covers both the standard ClickFix chain and a newer variant that skips ClickFix entirely.

The researchers say they still don't know how the sites were breached. Where they examined individual sites, most ran WordPress, and some ran PrestaShop. Each one carried a small injected script that reads its next payload from the contract and runs it in the visitor's browser.

Takedown resistance is the whole point. Because the payload lives in a smart contract, there's no hosting provider to notify and no registrar to seize a domain. The operator rewrites one contract and all 5,400 sites serve something new on the next page load.

That breaks the usual response playbook. Blocklists built around payload domains go stale quickly, and the delivery site is a real business that has no idea it's compromised. For an MSP, the exposure arrives through ordinary browsing to a clinic or a plumber's website, not through a phishing email.

Netskope also notes the final payload isn't fixed. Different visitors can reach different endings from the same delivery chain, so a single sample tells you less than it normally would.

The chain is short and it starts the same way everywhere, per Netskope's analysis.

1. A compromised site loads an injected loader, either an inline script or a spoofed package placed in a fake plugin directory.
2. The loader sends a JSON-RPC eth_call to a smart contract on a BSC testnet RPC endpoint.
3. The contract returns a second-stage script, which the loader executes in the visitor's browser.
4. That script blurs the page behind a fake CAPTCHA and tells the visitor to open the Windows Run dialog and paste a command.
5. The pasted PowerShell command downloads and runs the final payload.

Testnet rather than mainnet is a deliberate choice. Netskope explains that BSC testnet behaves like the production chain, but its BNB has no monetary value and is handed out free by faucets. The operator gets the same contract hosting and the same takedown resistance for nothing.

Later in the campaign, Netskope found a variant that replaces the ClickFix overlay with a WebRTC data-channel stager. The eth_call hands the browser a small block of JavaScript whose only job is to open a covert channel to the attacker and run whatever comes back through it.

Normally two WebRTC peers exchange session descriptions through a signaling server, which leaves DNS lookups, STUN/TURN traffic and DTLS handshake packets for defenders to see. This variant skips all of it. Netskope describes a script that "hand-writes the answer itself" and feeds it straight back into its own connection.

Every value a real negotiation would produce is hardcoded instead: the C2 IP, assembled from separate numbers so it never appears as a string, the UDP port, the ICE password and the server's DTLS fingerprint. The encrypted channel opens on the first packet, with no certificate exchange and no signaling traffic to observe.

Nothing is written to disk. The stager buffers each message, then executes the reassembled code when the channel closes or after a ten-second backstop. To satisfy the page's Content Security Policy it lifts the nonce from a legitimate script already on the page and reuses it on its own injected script tag, falling back to Function() when no nonce exists. The node is removed right after it runs.

Two groups. Site owners running WordPress or PrestaShop for a small business, whose visitors get served the lure, and any organization whose users browse the web without inspection of non-web traffic.

Netskope counted several hundred distinct sites active on any given day, with more than 300 beaconing on a typical weekday. BleepingComputer's September 5 report on the same research puts August's daily average at close to 400 sites, with a single-day peak of 536. The trend has climbed steadily since spring.

The victims share no industry, region or owner, so there's no vertical to warn specifically. All of these figures come from Netskope's own telemetry, which sees what its customers browse. Treat 5,400 as a floor rather than a total.

There's no patch here, because nothing is being exploited in the software sense. The defenses are network controls, site hygiene and user awareness.

• Block the full BSC testnet RPC pool, not just the primary endpoint. Netskope makes this point explicitly, since the loaders fall back to alternative endpoints.
• Monitor non-web UDP traffic for the WebRTC channel. HTTP inspection won't see it, and there's no signaling traffic to catch either.
• Integrity-check CMS assets on every site you manage. Netskope says the loader gets appended to a legitimate JavaScript file or dropped into a fake plugin directory, so a diff against a known-good copy will find it.
• Brief users on fake CAPTCHA prompts. Any page that asks you to paste a command into the Windows Run dialog is an attack, without exception.
• Pull the indicators from the public Netskope Threat Labs IOC repository and feed them into your blocklists and hunting queries.

Restricting the Run dialog through policy, or alerting on explorer.exe spawning PowerShell, closes the ClickFix path on managed endpoints. It does nothing about the WebRTC variant, which never leaves the browser.

Netskope Threat Labs says it's tracking the campaign and updating detection coverage for the RPC endpoints, delivery infrastructure and payloads. There's no vendor fix to wait for.

Two things are worth watching. Whether the WebRTC variant spreads beyond the sample Netskope pulled apart, and whether other operators copy the pattern of pairing on-chain payload storage with a transport that web proxies can't read. Netskope expects both.

The initial access question also stays open. Until someone explains how 5,400 small-business sites got injected in the first place, owners can't close the door, only keep checking the locks.

Visitors to more than 5,400 legitimate small-business websites can be served attacker-controlled JavaScript that either socially engineers them into running PowerShell or opens a covert browser command channel. The payload host is on-chain and cannot be taken down.

Security: Successful ClickFix execution gives the operator arbitrary code execution on a Windows endpoint. The WebRTC stager gives arbitrary JavaScript execution in the browser session.

Privacy: The final payload is not fixed, so data theft is plausible but unconfirmed for this specific campaign.

Netskope Threat Labs tracked more than 5,400 compromised small-business sites loading payloads from a BNB Smart Chain testnet contract, delivering ClickFix lures and, in a newer variant, a covert WebRTC command channel.