5,400 Hacked WordPress Sites Now Serve Malware Stored on a Blockchain

5,400 hacked websites are delivering malware that lives on a blockchain, and the host list is full of ordinary small-business WordPress shops

A malware operation that Netskope researchers have tracked for months runs on one mean idea: why rent servers when you can store your payload on a public blockchain and let it outlive every takedown attempt? According to Netskope’s reporting, more than 5,400 compromised websites, most of them WordPress and PrestaShop stores, are funneling visitors into a ClickFix lure whose next-stage code is fetched from a smart contract on the BNB Smart Chain Testnet.

The mechanics matter. Each infected site carries an injected script. When a visitor lands, the script shows a fake CAPTCHA that tells them to press Windows+R, open the Run dialog, and paste a PowerShell command they were told to copy. That is the ClickFix trick, and it works because the victim runs the malware themselves, walking it past the endpoint controls that would block a drive-by download.

The PowerShell command does not point at attacker infrastructure. It reaches out to the BSC Testnet, a free “practice” blockchain for developers, and pulls the real payload out of a smart contract. Netskope calls this technique EtherHiding. Because the code lives in an updatable contract, the attacker can swap what all 5,400 sites deliver at any moment, to everyone, at once.

And they did swap it. Later in the campaign, the ClickFix payload became a WebRTC stager. The stager fakes a peer-connection handshake, writing the session answer locally instead of waiting for a real peer, and opens an encrypted data channel straight to the operator. JavaScript comes down that channel, assembles itself in browser memory, and executes without ever touching disk.

Why this is hard to stop

The usual playbook against a malware hosting operation is: identify the infrastructure, complain to the host, watch it die. This operation breaks that loop at every joint.

• Delivery happens on 5,400 legitimate businesses. Shutting it down means notifying and remediating thousands of site owners, most of whom have no idea they are hosting the script.
• The payload sits on a blockchain. Nobody at BSC is going to deactivate a smart contract on request, and reading the contract’s data looks identical to normal developer traffic.
• The C2 channel is WebRTC, traffic that blends into the real-time communications most networks cannot block without breaking video calls.

Netskope’s telemetry shows the operation is not winding down. Roughly 400 of the compromised sites called the Testnet RPC endpoint every day in August, peaking at 536. Their advice to defenders is blunt: block the whole pool of BSC Testnet RPC endpoints at your egress, and alert on non-web UDP traffic. A desktop process suddenly holding a UDP session to a random peer is what this stager looks like from the outside.

What African enterprises should take from this

Two things, and neither is exotic.

First, your attack surface includes websites you do not manage. SMEs across the continent run WordPress and PrestaShop because they are cheap and fast to stand up, and a lightly-maintained CMS install is exactly the kind of site this campaign harvested. If a vendor, partner, or client site appears in your employees’ browsing, its compromise becomes your problem the moment someone pastes a command into the Run box.

Second, prevention scores will not save you here. Every stage of this chain, the fake CAPTCHA, the copy-paste, the encrypted channel, lives after the perimeter. Most security programs measure how well they keep attackers out and almost never how much damage they allow once a human does the attacker’s typing for them. Egress visibility is where the detection actually happens: knowing that a laptop in Finance just opened a UDP flow to a blockchain RPC.

eHawu’s network-layer controls are built for that gap. We profile every device on your network, and traffic that does not match a legitimate application shape, like a desktop process holding covert peer-to-peer sessions, gets flagged and stopped at the wire before the payload finishes assembling. Users will keep pasting what the screen tells them to paste. The network has to be the one that says no.