More than 5,400 websites have been quietly compromised and turned into delivery points for a scam that convinces visitors to infect their own computers, without the attackers needing to exploit anything on the visitor’s device directly. Instead of a traditional exploit, the compromised pages show what looks like a routine CAPTCHA check, then walk the visitor through copying and running a command manually. Researchers who tracked the campaign say what makes it unusually durable is where the malicious code itself is stored: not on a server that can be taken offline, but inside the blockchain.
More Than 5,400 Sites, No Common Thread
Researchers at cloud security platform Netskope identified more than 5,400 hacked websites carrying the malicious script, the large majority of them built on WordPress or PrestaShop, two of the most widely used website and online-store platforms. The affected sites span small businesses with little in common beyond their size and their choice of platform: clinics, plumbers, and e-commerce shops among them, with no shared industry, region or owner tying the victims together.
That spread suggests the initial compromise relies on scanning for a common vulnerability across many sites running the same platform, rather than any effort to target a specific type of business. According to reporting on the campaign, the injected script has continued spreading for months, with the number of affected sites climbing since the campaign was first observed in the spring.
WordPress and PrestaShop both power a large share of the small-business websites on the internet, run largely by owners who are not full-time website administrators and who often leave plugins, themes or the core software itself unpatched for long stretches. That gap, not any flaw unique to either platform’s core code, is the opening attackers typically use to inject scripts like this one at scale across thousands of unrelated sites in a relatively short window.
The Fake CAPTCHA That Asks for a Command
Rather than exploiting a browser flaw, the attack relies on tricking the visitor into doing the work. A visitor to a compromised page is shown what appears to be a standard CAPTCHA verification, the kind of routine “not a robot” check that has become common across the web. Instead of clicking checkboxes or selecting images, though, the fake prompt instructs the visitor to open the Windows Run dialog and paste in a command.
That command, once pasted and executed, launches a PowerShell process that downloads and runs the actual malicious payload. This general technique, known in the security industry as ClickFix, has become common precisely because it sidesteps most technical defenses: the malicious action is performed by the person sitting at the keyboard, using tools that are already trusted and built into Windows, rather than by an exploit that antivirus software might catch.
Security teams have watched ClickFix-style lures spread across a wide range of unrelated campaigns over the past couple of years, precisely because the approach requires no software vulnerability at all. Any attacker who can get a fake prompt in front of a visitor, whether through a hacked website, a malicious ad or a phishing email, can attempt the same trick, which is part of why the technique has become a recurring building block rather than a one-off gimmick tied to a single threat group.
Hiding Payloads Inside the Blockchain
What sets this campaign apart from earlier ClickFix operations is where the payload itself lives. Instead of hosting the malicious code on a server that a hosting provider or law enforcement could take down, the attackers stored it inside smart contracts on the BNB Smart Chain Testnet, a blockchain network. The injected script on each compromised site retrieves the next stage of the attack from that smart contract rather than from a conventional web address.
Security researchers refer to this approach as EtherHiding. Because a blockchain ledger is distributed across a wide network of computers and not controlled by any single host, taking the malicious content offline the way a hosting provider might suspend a server is not straightforward. Netskope’s own writeup of the technique notes that attackers can also edit the contents referenced by the smart contract at will, letting them update the payload without having to re-infect any of the compromised websites.
A Newer Variant Using WebRTC
The campaign has not stayed static since it was first identified. Later activity showed the threat actor replacing the original ClickFix payload with a different mechanism built around WebRTC, a technology normally used for real-time audio and video communication in browsers. In the updated variant, the payload sets up a covert, encrypted data channel back to the attacker rather than relying solely on the earlier download-and-execute pattern.
That shift suggests active, ongoing development of the campaign rather than a single tool deployed once and left running. Daily telemetry reviewed by researchers showed the number of infected sites actively communicating with the blockchain endpoints climbing through the summer, reaching a peak of more than 500 sites active on a single day.
Spotting the Fake Verification Prompt
The underlying defense against this type of attack does not depend on recognizing blockchain infrastructure or PowerShell syntax. No legitimate website verification step ever requires opening the Windows Run dialog or pasting in a command; that action alone is enough to compromise a system, regardless of what a webpage claims is happening. Any site presenting a “verification” step that asks for a manual command paste should be closed immediately rather than followed.
Because the compromise happens at the level of a legitimate business’s website rather than a suspicious-looking scam page, the usual visual cues, such as a strange domain name or a poorly designed layout, are frequently absent. The site itself is often real and previously trustworthy; only the injected script sitting inside it is not.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
