5,400 hacked sites serve up ClickFix payloads from the BNB blockchain

Researchers at the cloud platform Netskope have detailed a large-scale operation in which attackers are distributing a malicious payload through smart contracts on the blockchain. Over the past few months, the specialists have counted more than 5,400 hacked sites — most of them built on WordPress and PrestaShop.

The blockchain as takedown-proof hosting

How the initial breach happens remains unknown, but a script has been injected into the code of every site that pulls the next stage of the payload from a smart contract on the BSC test network. This technique has been dubbed EtherHiding. The BNB Smart Chain test network is meant for developers and works almost exactly like the main one, but it can be used for free. Storing malicious code on the blockchain gives the attackers resilient infrastructure that is extremely hard to take down, while the payload itself can be changed at any moment.

From a fake CAPTCHA to a covert channel

In the delivery chain observed at Netskope, the script displays a ClickFix lure: the visitor is shown a fake CAPTCHA and prompted to open the Windows “Run” dialog and paste a PowerShell command into it. Do that, and the final payload is downloaded to the machine and executed.

Later in the campaign, the attackers replaced the payload in the smart contract with a stager that uses a WebRTC data channel. As the researchers describe it, the script creates a peer-to-peer connection and a data channel and generates a standard WebRTC offer, but instead of sending it anywhere and waiting for a reply, it writes the reply itself and feeds it back in. No real handshake takes place, yet a channel to the attacker is opened all the same. The stager fetches JavaScript code from a hardcoded command-and-control server address, buffers it, and runs it directly in the browser's memory, adding it to the DOM without ever saving it to disk.

Growing in scale

According to Netskope, the operation engages more than 300 infected sites every day. Since spring, the number of compromised resources reaching out to BSC test RPC endpoints has grown steadily: in August, nearly 400 sites a day were contacting them, and the all-time peak was 536.

Defenders are advised to block the entire pool of BSC test RPC endpoints and to watch for WebRTC-related UDP traffic that is unusual for the web.

Source: Bleeping Computer