A widespread cybercriminal campaign is actively compromising over 5,400 small-business websites, predominantly built on **WordPress** and **PrestaShop**, to serve malicious payloads. Researchers at cloud security platform **Netskope** have uncovered the operation, which utilizes smart contracts on the **BNB Smart Chain (BSC)** Testnet for payload storage and delivery. ### EtherHiding: A Resilient Delivery Method The initial compromise vector for these websites remains unclear. However, each affected site has been injected with a script designed to retrieve the next-stage payload from a **BSC** Testnet smart contract. This method, dubbed **EtherHiding**, allows threat actors to store malicious code or configuration data on the blockchain, creating a highly resilient infrastructure that resists traditional takedown efforts. **Netskope** highlights that the **BSC** Testnet, while free for developers, functions similarly to the mainnet, offering attackers a robust and cost-effective platform for their operations. ### From ClickFix to Covert WebRTC Channels Initially, the campaign delivered a **ClickFix** lure. This involved displaying a fake **CAPTCHA** and instructing visitors to execute a **PowerShell** command, which would then download and run the final payload. A key advantage for the attackers is the ability to modify the payload within the smart contract at any time.  Later in the campaign, the threat actor updated the smart contract to deliver a **WebRTC** data-channel stager instead of the **ClickFix** payload. This newer variant establishes a covert, encrypted channel to the attacker's command-and-control (C2) server, enabling the execution of received code. **Netskope** explains the sophisticated nature of this **WebRTC** implementation: “The script creates a peer connection and a data channel, then generates the required session description offer just like a normal **WebRTC** handshake. But instead of sending that offer anywhere and waiting for a real reply, it **hand-writes the answer itself** and feeds it straight back into the connection. This way, no handshake happens, but a data channel to the cyberattacker still opens.”  The stager receives **JavaScript** code from a hardcoded **C2** address, buffers it, and executes it dynamically in the browser's memory without saving it to disk. This is achieved by adding the code to the head of the **DOM** when the channel closes or after ten seconds. ### Escalating Threat and Defensive Measures **Netskope** warns of the escalating nature of this operation, noting that over 300 infected websites are actively involved daily. Since spring, the number of compromised sites contacting **BSC** Testnet RPC endpoints has shown a consistent increase, peaking at 536 daily in August. To mitigate this threat, security professionals are advised to block the entire pool of **BSC** Testnet RPC endpoints, which **Netskope** has provided [here](https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Malware/Amatera%20ClickFix). Additionally, monitoring for non-web **UDP** traffic associated with **WebRTC** is crucial for detecting and preventing this advanced form of attack.