Over 5,400 sites serve ClickFix blockchain malware via BNB Smart Chain
Cybercriminals have compromised over 5,400 websites to deliver malicious ClickFix payloads by leveraging smart contracts on the BNB Smart Chain. The campaign uses WebRTC data-channel stagers to execute code directly in browser memory, bypassing traditional disk-based security detection.
Key Takeaways
- Attackers compromised 5,400 WordPress and PrestaShop sites to host malicious scripts via the EtherHiding technique.
- Malicious payloads are stored in BNB Smart Chain Testnet smart contracts, allowing attackers to modify code at any time.
- The campaign uses WebRTC data channels to establish encrypted connections that execute JavaScript without saving files to disk.
- Netskope telemetry shows an average of 400 infected websites contacting blockchain endpoints daily, peaking at 536.
Why It Matters
This campaign signals a sophisticated shift in how attackers maintain resilient infrastructure by using decentralized ledgers to host volatile payloads. For the streaming and web delivery ecosystem, the use of WebRTC data channels to bypass memory-based detection represents a significant threat to browser-based security models. As these decentralized techniques mature, security teams must shift focus from file-based scanning to monitoring non-web UDP traffic and blocking specific blockchain RPC endpoints. Watch for increased adoption of EtherHiding tactics across larger content management systems as attackers seek to harden their command-and-control delivery chains against traditional takedown efforts.
Additional Context
The rise of smart device security ratings highlights a growing global push to regulate the hardware and software vulnerabilities that malicious actors exploit to compromise connected environments, a trend further underscored by recent LG smart TV privacy investigations into unauthorized data collection and the broader TPN security initiative aimed at mitigating supply chain risks.
Read full article at bleepingcomputer.com
Enjoy our coverage?
Add StreamingMeme as a preferred source on Google to see more of our streaming news at the top of your Search results.
Add as preferred source