Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain

A large-scale cybercriminal campaign has compromised over 5,400 websites, primarily built on WordPress and PrestaShop, to deliver malicious payloads via the ClickFix exploit. The attack chain uses a technique called EtherHiding, where malicious code is stored in smart contracts on the BNB Smart Chain (BSC) Testnet, making takedown efforts difficult. Victims are lured into executing a PowerShell command through a fake CAPTCHA prompt, leading to payload execution; later variants use a WebRTC-based stager that establishes a covert encrypted channel to receive and execute JavaScript code directly in browser memory.

AI-extracted · verify before operational use