5,400+ Compromised Sites Used to Deliver ClickFix Payloads via BNB Smart Chain Smart Contracts

What Happened

According to BleepingComputer, researchers have identified a large-scale campaign in which more than 5,400 compromised small-business websites are being used to serve ClickFix-style payloads. Notably, the payload delivery infrastructure is reportedly stored in smart contracts on the BNB Smart Chain (BSC), a technique known as "EtherHiding" that abuses blockchain immutability to host malicious code outside the reach of conventional takedown efforts. Details on the specific threat actor, victim targeting, and downstream malware families were not specified in the source reporting at time of writing.

Why It Matters

ClickFix attacks rely on social engineering — tricking users into pasting and executing attacker-supplied commands (often framed as a "fix" for a fake error) — making them effective regardless of browser or endpoint hardening. Storing payload infrastructure on a public blockchain gives operators a resilient, decentralized hosting layer that is difficult for defenders and takedown services to disrupt using standard domain/IP blocklisting. The scale reported here — thousands of legitimate small-business sites acting as unwitting distribution points — means exposure isn't limited to any single industry or region; any organization whose employees browse the open web is potentially at risk.

What Defenders Should Watch For

• Monitor for the classic ClickFix behavior pattern: users being prompted to open the Windows Run dialog, PowerShell, or a terminal and paste/execute a command copied from a webpage.
• Hunt for outbound connections from endpoints to blockchain RPC/API endpoints (e.g., BSC node providers) immediately following clipboard or script execution activity — this is unusual for typical user workflows.
• Flag process trees where a browser process spawns powershell.exe, cmd.exe, mshta.exe, or similar living-off-the-land binaries shortly after a page load.
• Review web content security controls and consider clipboard-paste/command-execution awareness training, since this technique bypasses traditional malicious-download detection.
• Track threat intel feeds for indicators (compromised site lists, associated smart contract addresses) as they become available.

Developing Story

This is net-new intelligence and further technical detail — including specific IOCs, targeted regions, and the malware ultimately delivered — may emerge as researchers continue investigating. No CVE is associated with this campaign. For the full report, see BleepingComputer's coverage.