A visitor loads the website of a local clinic or a plumbing firm, and the page blurs. A box in the middle asks them to prove they are human. The instructions are unusual: open the Windows Run dialog, paste the text that has just been copied, and press Enter. Anyone who complies has just run a command that downloads malware.
The trick is known as ClickFix, and it is everywhere this year. What makes the campaign described this week by Netskope Threat Labs stand out is where the fake CAPTCHA comes from. More than 5,400 hacked websites are fetching it from a smart contract on a blockchain, which gives the criminals behind it a hosting arrangement that nobody can shut down.
A dead drop that cannot be seized
Netskope noticed thousands of unrelated small business sites making the same odd request to an endpoint of the BNB Smart Chain test network. The sites belonged to more than 2,200 organizations around the world and had nothing in common beyond their size. Where the researchers looked closely, most ran WordPress and some ran PrestaShop. How they were broken into is not known.
Each one carried a few lines of injected code, either added to a legitimate script file or tucked into a directory made to look like a plugin. When a page loads, that code asks a smart contract on the chain for its next instructions and runs whatever comes back in the visitor's browser.
The technique has a name, EtherHiding, and its appeal is obvious. A normal malware server can be taken offline by its hosting company or lose its domain. A smart contract has no host and no registrar. The operator can also change what all 5,400 sites deliver at once by updating that single contract, and visitors start receiving the replacement the next time a page is opened.
The choice of the test network is a small economy on top of that. The production chain charges real money for every deployment and update. The test network exists for developers, behaves the same way and hands out its tokens for free.
The operation is growing. Netskope says several hundred of the compromised sites are active on any given day, currently more than 300 each weekday, and that the number has climbed steadily since the spring.
A second payload that skips the handshake
When the researchers took apart what a handful of the hacked sites were actually receiving, they found that some were no longer being served the fake CAPTCHA at all. The contract returned a different script whose only job is to open a hidden channel to the attacker and run the code sent through it.
It does this with WebRTC, the browser technology behind video calls. Two browsers normally set up such a connection by exchanging details through a signaling server, and that exchange leaves traces a defender can see. This script generates its own offer and then writes the reply by hand, with the attacker's address, port and encryption fingerprint already filled in. As far as the browser is concerned the negotiation succeeded. In reality nothing was negotiated, and an encrypted channel over UDP opens on the first packet.
Whatever arrives over that channel is held in memory and run once the connection shuts, with a ten second timer as a fallback. Nothing is saved to disk. To get past a site's content security policy, the script copies the nonce from a script the site itself loaded, and it deletes its own traces once it has run.
Netskope's advice for network defenders is to block the whole pool of test network endpoints, not only the main one, and to watch for WebRTC traffic that ordinary web inspection never sees. Owners of small sites should check the integrity of their script files and plugin directories, since that is where the loader hides.
