# Researchers link 5,400 hacked sites to blockchain-hosted ClickFix campaign

_Published Saturday, September 5, 2026 at 11:06 AM EDT · Security · Latest · Tier 2 — Notable_

![Researchers link 5,400 hacked sites to blockchain-hosted ClickFix campaign — Primary](https://www.bleepstatic.com/content/hl-images/2025/03/18/Blockchain.jpg)

Researchers identified more than 5,400 compromised websites, mostly built on WordPress and PrestaShop, that deliver ClickFix lures using payloads stored in BNB Smart Chain testnet smart contracts.

Netskope said injected scripts show fake CAPTCHAs that direct visitors to run a PowerShell command, which downloads and executes a final payload. The operator later replaced the ClickFix payload with a WebRTC data-channel stager that receives and executes code in browser memory. Netskope said the operation uses more than 300 infected sites each day.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/over-5-400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain/)

---
Canonical: https://techandbusiness.org/newswire/Yphbw8ZmlWPunDICcecIfu
Published: 2026-09-05T15:06:10.646Z
Story chronology: 2026-09-05T14:29:13.000Z
Retrieved: 2026-10-20T21:16:55.468Z
Publisher: Tech & Business (techandbusiness.org)