# Researchers link 5,400 hacked sites to blockchain-hosted ClickFix campaign

_Saturday, September 5, 2026 at 10:29 AM EDT · Security · Latest · Tier 2 — Notable_

![Researchers link 5,400 hacked sites to blockchain-hosted ClickFix campaign — Primary](https://www.bleepstatic.com/content/hl-images/2025/03/18/Blockchain.jpg)

Researchers identified more than 5,400 compromised websites, mostly built on WordPress and PrestaShop, that deliver ClickFix lures using payloads stored in BNB Smart Chain testnet smart contracts.

Netskope said injected scripts show fake CAPTCHAs that direct visitors to run a PowerShell command, which downloads and executes a final payload. The operator later replaced the ClickFix payload with a WebRTC data-channel stager that receives and executes code in browser memory. Netskope said the operation uses more than 300 infected sites each day.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/over-5-400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain/)

---
Canonical: https://techandbusiness.org/newswire/Yphbw8ZmlWPunDICcecIfu
Retrieved: 2026-09-05T17:42:00.429Z
Publisher: Tech & Business (techandbusiness.org)