EtherHiding has been used on more than 5,400 compromised small-business websites to fetch payloads from BNB Smart Chain testnet smart contracts, enabling takedown-resistant delivery of ClickFix lures or a covert WebRTC command channel. Netskope says the campaign spans over 2,200 organizations worldwide and continues to grow as operators rewrite a single on-chain contract to change what victims receive. #EtherHiding #BNBSmartChain #ClickFix #WebRTC
Keypoints
- EtherHiding stores attack payloads in BNB Smart Chain testnet smart contracts, making delivery infrastructure harder to remove.
- More than 5,400 compromised websites were observed, mostly small-business sites such as clinics, plumbers, and e-commerce shops.
- The compromised sites were spread across more than 2,200 organizations worldwide, with several hundred active on any given day.
- Most examined sites were WordPress, with some PrestaShop installations also affected; the initial compromise vector remains unknown.
- The standard attack chain uses an injected loader to call a BSC testnet contract, then serves a ClickFix overlay that tricks users into running a command.
- A newer variant replaces ClickFix with a covert WebRTC data channel that opens a hidden command-and-control path.
- Netskope recommends blocking the full BSC-testnet RPC pool, monitoring WebRTC traffic, and integrity-checking CMS assets.
MITRE Techniques
- [T1059.001 ] PowerShell – The pasted command is described as a downloader that pulls and runs the final payload (‘paste a command’ and ‘PowerShell command added to the victim’s clipboard’).
- [T1059 ] Command and Scripting Interpreter – The victim is instructed to run a command from the fake CAPTCHA overlay, leading to execution of attacker-controlled code (‘open a Run dialog and paste a command’).
- [T1027 ] Obfuscated Files or Information – The loader is described as an injected obfuscated inline script used to hide malicious behavior (‘Injected obfuscated inline script’).
- [T1105 ] Ingress Tool Transfer – The final payload is downloaded by the command executed on the victim system (‘pulls and runs the final payload’).
- [T1102 ] Web Service – The campaign uses blockchain smart contracts and RPC calls as an external delivery mechanism for payload retrieval (‘reads its next payload from a smart contract’).
- [T1090 ] Proxy – The WebRTC variant creates an indirect covert channel to the attacker and bypasses normal signaling visibility (‘opens a covert channel to the cyberattacker’).
- [T1071.001 ] Web Protocols – The campaign uses browser-based WebRTC communications and HTTP-delivered scripts for command transfer (‘WebRTC powers browser-based video calls and peer-to-peer data’).
- [T1056.001 ] Keylogging – Not mentioned in the article; omitted if absent.
- [T1055 ] Process Injection – Not mentioned in the article; omitted if absent.
- [T1059.004 ] Unix Shell – Not mentioned in the article; omitted if absent.
- [T1132.001 ] Data Encoding: Standard Encoding – The C2 IP is built from separate numbers so it never appears as a string (‘built from separate numbers so it never appears as a string’).
- [T1601 ] Modify System Image – The stager reuses a legitimate script nonce and injects code into the DOM to appear authorized (‘reuses it on its own injected ‘).
Indicators of Compromise
- [Domains / RPC endpoints ] BSC testnet RPC infrastructure used for payload retrieval and beacons – BNB Smart Chain testnet endpoint, full BSC-testnet RPC pool
- [File names / Web assets ] injected loaders placed on compromised sites – legitimate JavaScript file, fake plugin directory
- [Web technologies / protocols ] attacker communication and payload delivery – JSON-RPC eth_call, WebRTC data channel
- [Web platforms ] affected site platforms observed during investigation – WordPress, PrestaShop
- [Network artifacts ] covert channel setup details embedded in the stager – UDP port, ICE password, DTLS fingerprint
- [Script/content artifacts ] malicious browser-delivered code and lure content – ClickFix overlay, injected obfuscated inline script
Read more: https://www.netskope.com/blog/malware-on-the-blockchain-an-ongoing-campaigns-new-webrtc-twist