Netskope reported on 5 September 2026 that more than 5,400 compromised websites, mostly WordPress and PrestaShop, are injecting scripts that fetch their next stage from smart contracts on the BNB Smart Chain testnet.

Around 300 of those sites contact the endpoints on any given day, peaking at 536 daily calls in August.

EtherHiding, and the word that matters

EtherHiding — storing malicious code or configuration inside a blockchain smart contract — has been around for a while. The technique is not the news.

The word that matters is testnet. A testnet exists for developers: it behaves like the production chain and it is free — no gas, no funding, no wallet. Everything that made EtherHiding attractive on mainnet is still here: nobody you can email hosts the contract, and the operator can rewrite the payload whenever they like. What the testnet removes is the cost of doing so — bulletproof hosting at 0 marginal cost.

That is bulletproof hosting with a marginal cost of zero, running on infrastructure maintained by the chain's own developers for the benefit of people building software.

There is genuinely very little defenders can do at the source. The realistic control is at the network edge: block or alert on your users' machines and servers reaching blockchain RPC endpoints they have no business reaching. For most organisations that is a short list of destinations nobody needs.

The lure is a fake CAPTCHA

The payload chain ends in ClickFix: the compromised page shows a fake CAPTCHA and tells the visitor to complete verification by pasting a command into the Windows Run dialog and pressing Enter. Around 300 of the compromised sites serve that lure on any given day. Nothing downloads and executes on its own — the visitor types the command themselves, which routes around a great deal of automated control.

The reason this pattern keeps working is that it never downloads and executes anything on its own. The user types the command. That routes around a great deal of automated control, and the fake CAPTCHA supplies the reason — everybody has clicked a verification box, and being asked to do one more step to prove you are human does not feel like an attack.

We covered a variant of this that ran through Windows Terminal; the wrapper changes, the "you are doing this yourself" mechanic does not.

The stager avoids the other takedown target

The payload has changed over the campaign. It began as ClickFix malware and was later replaced with a WebRTC data-channel stager.

The interesting detail is how it establishes the channel. Rather than negotiating through a signalling server the way a legitimate WebRTC application does, the stager writes its own answer and feeds it straight back into the connection, standing up an encrypted channel without a handshake against third-party infrastructure.

Put that beside the blockchain hosting and a pattern appears. Both choices remove a thing defenders can seize. No hosting provider for the payload, no signalling server for the channel — the operator has systematically deleted the intermediaries that a takedown normally targets.

The numbers deserve care

5,400 compromised sites and 300 daily active are different measurements and both are real. The infection footprint is the larger number; the number actually calling home on a given day is much smaller.

Neither tells you how many people saw a fake CAPTCHA, and none of the reporting says how many ran the command. Nobody should convert 5,400 into an implied victim count.

What to do

  • If you run WordPress or PrestaShop, assume you are in the candidate pool. The initial compromise method has not been identified, which means nobody can tell you which plugin to check. Update everything and audit for injected script tags.
  • Block outbound access to blockchain RPC endpoints from workstations and web servers. This is the highest-value control available and almost nobody needs those destinations.
  • Look for script injections that fetch from an RPC URL, not for a specific domain. The contract address is stable; the fetching code is what is on your site.
  • Alert on Run dialog usage. ClickFix depends on it, and legitimate use of the Run dialog to paste a long encoded command is close to nonexistent in a managed estate.
  • Teach the fake CAPTCHA specifically. A real CAPTCHA never asks you to open a dialog and paste something.

What is not established

  • How the 5,400 sites were compromised. Not identified.
  • Who is behind it. No attribution.
  • How many people executed the command. No figure published.
  • What the WebRTC stager ultimately delivers.
  • Whether the operators pay anything at all. No transaction costs have been reported, which is consistent with the testnet being free.