Researchers at cloud security platform Netskope uncovered a large-scale criminal operation exploiting more than 5,400 hacked websites to distribute malicious payloads to visitors. Most of the affected sites are small business websites built using WordPress and PrestaShop, while the initial compromise method that enabled the attackers to plant the code remains unknown.
The campaign relies on a technique known as EtherHiding, in which the hacked websites contain JavaScript code that retrieves the next payload from a smart contract through an endpoint for the BNB Smart Chain Testnet. Designed primarily for developers, this network provides functionality similar to the mainnet while allowing free use, making it a relatively low-cost option for attack infrastructure.
How Does the Payload Reach the Victim?
In the stage observed by Netskope, the code displays a fake CAPTCHA-style scam page to the visitor. The page asks the user to open the Run window in Windows and then paste a PowerShell command. Executing this step downloads the final payload and runs it on the device.
Storing the code inside a smart contract gives the attackers the ability to modify the payload without needing to re-compromise the infected websites. The ClickFix payload was later replaced with a preliminary component that relies on a WebRTC data channel, showing that the campaign does not use the same infrastructure in a fixed manner.
A WebRTC Channel for Executing Code in the Browser
According to the researchers’ explanation, the component creates a peer connection and a data channel, then generates a WebRTC session offer, manually writes the connection answer, and enters it directly into the session. This opens a data channel with the attacker without carrying out a conventional WebRTC handshake.
The component then receives JavaScript code from a hardcoded command-and-control address, temporarily stores it in browser memory, and executes it when the channel closes or after ten seconds have elapsed. The received code is not saved to disk; instead, it is added to the head of the DOM structure and executed dynamically.
What Matters to Defense Teams?
Netskope says the operation uses more than 300 infected websites daily. Measurement data also showed that the number of websites connecting to RPC endpoints for the BNB Testnet had continued to rise since spring, approaching 400 websites per day during August, with a peak of 536 websites recorded.
In practice, the risk is not limited to the hacked website itself; the site becomes a distribution point for payloads that can be changed centrally, while subsequent connections may appear to be traffic associated with WebRTC technology. Netskope recommends that defenders block the set of RPC endpoints for the BNB Testnet and monitor UDP traffic not typically associated with web services.
The source does not specify how the compromises began, nor does it name the victims or the final payload that runs after the PowerShell command is executed. Therefore, the nature of the ultimate targets and the scope of the impact on visitors’ devices remain open questions, although the number of affected websites and the changing distribution mechanism make the campaign directly important to website owners and browser and network security teams.