“The script creates a peer connection and a data channel, then generates the required session description offer just like a normal WebRTC handshake,” Netskope researchers wrote — and then the attackers simply forge the reply themselves to open a covert channel. That single line captures a campaign that now uses more than 5,400 compromised small-business websites to distribute modular malware whose payloads live on the BNB Smart Chain test network.
Scope: 5,400+ compromised sites, mostly WordPress and PrestaShop
Researchers at cloud security platform Netskope identified more than 5,400 hacked websites being used to deliver what the report calls ClickFix payloads. Most of the affected sites are built on WordPress and PrestaShop. Netskope’s telemetry shows the operation is large and sustained: the attackers use over 300 infected websites every day, with nearly 400 sites contacting the BSC Testnet RPC endpoint on average each day in August and an all-time daily peak of 536.
EtherHiding and BSC Testnet smart-contract storage
The campaign’s distinguishing technical choice is to store payloads and configuration data inside smart contracts on the BNB Smart Chain (BSC) Testnet. Netskope explains that the BSC Testnet is designed for developers and functions like the mainnet while being available free of charge. The technique — known in the report as EtherHiding — places malicious code in blockchain smart contracts, giving attackers a resilient delivery infrastructure that is difficult for defenders to take down and straightforward for the adversary to update: because the payload lives on-chain, “they can modify it at any time,” Netskope notes.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleClickFix lure, PowerShell delivery, and WebRTC stager
Across the infected sites, an injected script presents a ClickFix lure: a fake CAPTCHA that instructs visitors to open the Windows Run dialog and paste a PowerShell command. Executing that command downloads and runs the final payload. Netskope documents a later evolution of the campaign in which the smart-contract-resident ClickFix payload is replaced by a WebRTC data-channel stager.
In the newer variant, the malicious script creates a peer connection and a data channel, generates a session description offer, then “hand-writes the answer itself and feeds it straight back into the connection. This way, no handshake happens, but a data channel to the cyberattacker still opens,” Netskope wrote. The stager pulls JavaScript from a hardcoded command-and-control (C2) address, buffers the received code, and executes it when the channel closes or after ten seconds. The received code is assembled in browser memory and executed dynamically by injecting it into the head of the DOM — without writing files to disk.
Telemetry, daily scale, and shifting tactics
Netskope’s telemetry indicates steady growth since spring in the number of compromised websites contacting BSC Testnet RPC endpoints. The researchers warn the campaign uses hundreds of infected sites each day and that the actors periodically change what lives in the smart contracts. Because the infrastructure draws on the Testnet, the adversary can operate without paying blockchain fees while keeping the payloads outside traditional hosting and takedown mechanisms.
The report also includes a defender-oriented recommendation: block the entire pool of BSC Testnet RPC endpoints the researchers provide and monitor for non-web UDP traffic associated with WebRTC, a sign that the stager technique may be in play. Netskope adds that defenders can be blindsided once attackers gain valid credentials: “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” The Blue Report 2026 — cited in the briefing — measures defenses technique by technique across 338 million simulations run in customer production environments.
What this means for technologists, small-business site owners, and visitors
- Technologists and security teams: Monitor and block BSC Testnet RPC endpoints as Netskope recommends, and watch for anomalous non-web UDP traffic or unexpected WebRTC channels originating from web pages. Investigate injected scripts that pull code from blockchain endpoints or attempt to persuade users to run PowerShell commands.
- Small-business website owners and administrators: Many of the infected sites are WordPress and PrestaShop installations — owners should inspect pages for injected scripts, harden credentials, and treat any unexpected site behavior as potentially indicating a deeper compromise. The initial compromise vector in this campaign remains unknown, increasing the urgency of routine hygiene.
- Visitors and end users: The lure includes a fake CAPTCHA instructing Windows users to paste a PowerShell command into the Run dialog. Follow the precautionary rule to never execute commands copied from a web page or run unsolicited instructions that modify your system.
The campaign combines simple social engineering with a harder-to-disrupt delivery mechanism: on-chain storage on a public test network and a clever in-browser stager that avoids disk artifacts. Netskope’s findings leave two concrete realities for defenders: the initial compromise method is still unknown, and the adversary’s ability to update payloads in smart contracts gives them a moving target. Blocking testnet RPC endpoints and hunting for unexpected WebRTC traffic are clear immediate actions — but the operation’s scale and adaptability raise the tougher question Netskope’s telemetry flags: how to detect and interrupt campaigns that intentionally place their payloads beyond traditional hosting and takedown channels?
