Cybercriminals have compromised over 5,400 websites to deliver malicious ClickFix payloads by leveraging smart contracts on the BNB Smart Chain. The campaign uses WebRTC data-channel stagers to execute code directly in browser memory, bypassing traditional disk-based security detection.
This campaign signals a sophisticated shift in how attackers maintain resilient infrastructure by using decentralized ledgers to host volatile payloads. For the streaming and web delivery ecosystem, the use of WebRTC data channels to bypass memory-based detection represents a significant threat to browser-based security models. As these decentralized techniques mature, security teams must shift focus from file-based scanning to monitoring non-web UDP traffic and blocking specific blockchain RPC endpoints. Watch for increased adoption of EtherHiding tactics across larger content management systems as attackers seek to harden their command-and-control delivery chains against traditional takedown efforts.
The rise of smart device security ratings highlights a growing global push to regulate the hardware and software vulnerabilities that malicious actors exploit to compromise connected environments, a trend further underscored by recent LG smart TV privacy investigations into unauthorized data collection and the broader TPN security initiative aimed at mitigating supply chain risks. Future developments in smart home interoperability may further complicate these security landscapes as more devices adopt real-time communication protocols.
A massive cybercriminal campaign has compromised over 5,400 WordPress and PrestaShop websites to distribute ClickFix malware. By leveraging BNB Smart Chain smart contracts and WebRTC data channels, attackers execute malicious code directly in browser memory. This technique bypasses traditional disk-based security, marking a significant shift toward resilient, decentralized command-and-control infrastructure.
It is a cybercriminal operation that uses smart contracts on the BNB Smart Chain to host and deliver malicious payloads to over 5,400 compromised websites.
The malware uses WebRTC data channels to execute JavaScript directly in browser memory, which allows it to avoid saving files to the disk and bypass traditional file-based security detection.
EtherHiding is a method where attackers store malicious payloads within blockchain smart contracts, allowing them to modify the code at any time and maintain resilient infrastructure.
The campaign primarily targets WordPress and PrestaShop websites, with Netskope reporting an average of 400 infected sites contacting blockchain endpoints daily.
Add StreamingMeme as a preferred source on Google to see more of our streaming news at the top of your Search results.
Add as preferred source