A large-scale cybercrime operation has compromised over 5,400 small-business websites, predominantly built on WordPress and PrestaShop, to deliver malicious payloads stored on the BNB Smart Chain (BSC) Testnet. This technique, known as EtherHiding, leverages smart contracts to host the next-stage payload, providing a resilient infrastructure that is difficult for defenders to dismantle.
Researchers at Netskope identified the campaign, noting that the compromised websites were injected with a script designed to retrieve the subsequent payload from a smart contract on the BSC Testnet endpoint. The initial compromise method for these sites remains undetermined. The BSC Testnet, intended for developers, functions similarly to the mainnet but is available free of charge, making it an attractive option for threat actors seeking to store malicious code or configuration data.
Initially, the campaign delivered a "ClickFix" lure, which displayed a fake CAPTCHA and prompted visitors to open the Windows Run dialog and paste a PowerShell command. Executing this command would download and run the final payload on the victim's machine. A key advantage for the attackers in using smart contracts is the ability to modify the payload at any time.
In a later evolution of the campaign, the threat actor replaced the ClickFix payload in the smart contract with a WebRTC data-channel stager. This newer variant establishes a covert, encrypted channel to the attacker and executes received code. The script creates a peer connection and a data channel, generating a session description offer akin to a standard WebRTC handshake. However, instead of transmitting this offer and awaiting a genuine reply, the script self-generates the answer and feeds it back into the connection, thereby opening a data channel to the cyberattacker without a full handshake.
The stager then receives JavaScript code from a hardcoded command-and-control (C2) address, buffers it, and executes it dynamically in the browser's memory when the channel closes or after ten seconds. This code is not saved to disk but is added to the head of the Document Object Model (DOM).
Netskope's telemetry data indicates a consistent increase in the number of compromised sites contacting the BSC Testnet RPC endpoints since spring. The operation utilizes over 300 infected websites daily, with nearly 400 sites calling the endpoint daily in August, peaking at 536. Defenders are advised to block the entire pool of BSC Testnet RPC endpoints and monitor for non-web UDP traffic associated with WebRTC to mitigate the threat.
