Researchers link 5,400 hacked sites to blockchain-hosted ClickFix campaign
Image: Primary Researchers identified more than 5,400 compromised websites, mostly built on WordPress and PrestaShop, that deliver ClickFix lures using payloads stored in BNB Smart Chain testnet smart contracts.
Netskope said injected scripts show fake CAPTCHAs that direct visitors to run a PowerShell command, which downloads and executes a final payload. The operator later replaced the ClickFix payload with a WebRTC data-channel stager that receives and executes code in browser memory. Netskope said the operation uses more than 300 infected sites each day.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
