What just happened (the short, spooky version)

Researchers uncovered a large-scale scheme where attackers quietly injected thousands of small-business websites — mostly running WordPress and PrestaShop — with malicious JavaScript that fetches its next-stage payload from the blockchain. In total, the operation touched 5,400 hacked sites, and the crooks used the Binance Smart Chain test network as their drop point.

Why the blockchain? Because storing code inside a smart contract gives the attackers a stubborn, hard-to-shutdown place to host payloads and configuration. They can change or swap the payload on a whim, and defenders have a heck of a time taking that down.

How the attack works and what to watch for

Here’s the delivery chain, boiled down with less doom and more clarity:

  • An unknown initial compromise injects a script into a site’s pages.
  • The script reaches out to a smart contract on the BSC Testnet and pulls the next-stage code (a trick sometimes called EtherHiding).
  • Early versions displayed a fake ClickFix/CAPTCHA prompt that told visitors to open the Windows Run box and paste a PowerShell command — which then downloaded and ran the payload.
  • Later, the attackers switched to a clever JavaScript stager that uses a WebRTC data-channel trick. It fakes the handshake (it literally writes the answer itself), opens a data channel, receives JavaScript from a hardcoded C2 address, buffers it, then assembles and executes it directly in browser memory — no disk footprint.

Because the malicious payloads live inside a smart contract, the adversary can swap from one attack method to another without touching the compromised sites again. That’s why telemetry showed the campaign using more than 300 infected sites per day, with a peak of around 536 sites calling the endpoint on busy days.

One more eyebrow-raiser: once attackers are operating with valid credentials in a victim environment, typical defenses perform much worse — only about 37% of their actions get blocked in those scenarios. Translation: initial access often means the fun’s just getting started for the attacker.

Quick technical notes you can use when talking to engineers:

  • Payload delivery: smart contract reads on BSC Testnet RPC endpoints.
  • Stager behavior: WebRTC peer connection opened without a real remote handshake; JS code is buffered and injected into the DOM head for execution.
  • Persistence on the blockchain side: easy to update and hard to seize or sinkhole.

Practical steps — what to do right now

Yes, it’s annoying, but you can make life harder for these actors. Suggestions for defenders and site owners:

  • Block calls to known BSC testnet RPC endpoints at your network edge and in your web filters.
  • Watch for unusual non-web UDP traffic and unexpected WebRTC-like sessions from web servers or user browsers.
  • Scan WordPress and PrestaShop installs for injected scripts, unknown cron jobs, and modified theme/plugin files; rotate credentials and tighten admin access.
  • Train staff and users: never paste random commands into Run or a terminal just because a site told you to.
  • Harden web apps: WAF rules, plugin/vendor updates, and least-privilege file permissions make these injections harder to pull off.
  • Monitor telemetry: if hundreds of sites in your fleet begin calling exotic blockchain RPC endpoints, treat it as an incident.

Bottom line: this campaign is creative and persistent because the blockchain gives the attackers flexibility. Keep your sites patched, your admin creds guarded, and your network filters blocking the weird stuff.