GoKawiil5,400+ hacked WordPress and PrestaShop sites push ClickFix malware via BNB Smart Chain
Netskope researchers found over 5,400 compromised small-business websites, mostly running WordPress and PrestaShop, injected with scripts that fetch malicious payloads from smart contracts on the BNB Smart Chain Testnet. Visitors are shown a fake CAPTCHA that tricks them into pasting a PowerShell command via the Windows Run dialog, which downloads and runs the attacker's final payload. Later in the campaign, attackers swapped the ClickFix payload for a stealthier WebRTC data-channel stager that opens a covert encrypted connection without a genuine handshake.
GoKawiil's interpretation of the reporting above, not reported fact.
By storing malicious code in blockchain smart contracts—a technique called EtherHiding—attackers create infrastructure that's essentially free, decentralized, and extremely resistant to takedown efforts by security teams or hosting providers. The ability to update payloads on the fly, combined with social-engineering tricks like ClickFix, shows how attackers are blending Web3 infrastructure with old-school deception to build more durable and adaptable malware distribution networks.
- Over 5,400 hacked sites, mostly WordPress and PrestaShop, are serving malware payloads hidden in BNB Smart Chain smart contracts.
- The EtherHiding technique lets attackers store and freely update malicious code on the blockchain, making takedowns very difficult.
- The campaign evolved from a ClickFix fake-CAPTCHA lure to a stealthier WebRTC-based covert channel for delivering payloads.
Yubico YubiKey 5 NFC Security Key — Since ClickFix campaigns often start with hijacked WordPress and PrestaShop admin accounts, a hardware security key is one of the strongest ways to lock down your site logins. The YubiKey 5 NFC plugs into USB-A and taps to phones over NFC, adding phishing-resistant two-factor authentication to WordPress, hosting panels and email accounts.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-05
Published there as: “Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.