Malware on the Blockchain: EtherHiding/Amatera ClickFix Campaign Adds a Covert WebRTC C2 Channel
Malware on the Blockchain (TL-2026-2311), also tracked as Amatera ClickFix, is a high-severity malware campaign, first published 2026-09-03. It has no confirmed attribution, affects WordPress WordPress CMS, maps to 15 MITRE ATT&CK techniques (T1027, T1027.003, T1036), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-2311
- Threat ID
- TL-2026-2311
- Also known as
- Amatera ClickFix, EtherHiding WebRTC C2 Variant
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-03
- Last reviewed
- 2026-09-03
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- ecommerce, general opportunistic web audiences
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Malware on the Blockchain
Malware and tooling: ACR Stealer, AcridRain, Amatera Stealer
Netskope Threat Labs documents an evolving, financially motivated campaign that compromises WordPress and PrestaShop sites to run ClickFix/fake-reCAPTCHA lures resolving payloads from a mutable blockchain smart contract (EtherHiding), ending in the Amatera credential stealer. A newly disclosed variant abandons the smart-contract lookup for a covert, hand-crafted WebRTC data channel to reach its C2 directly over UDP.
How Malware on the Blockchain works
Netskope Threat Labs tracks an active, growing malware-distribution campaign that abuses compromised WordPress and PrestaShop websites as a delivery front for the Amatera password stealer (aka ACR Stealer / AcridRain Stealer). As of the September 3, 2026 disclosure, Netskope counted 5,400+ compromised websites and 2,200+ affected organizations worldwide, with roughly 300 sites actively serving the payload per day and the count trending upward since spring 2026.
In the primary infection chain, attackers plant a rogue WordPress must-use plugin (named in the pattern site-helper-<hex>) that auto-loads with the site and registers a malicious Service Worker (nochain-sw.js) in visiting browsers. The Service Worker intercepts page requests, strips the site's Content-Security-Policy header, and injects a Base64-encoded loader that calls a mutable smart contract on the Base blockchain (0x58460d0b3d4d6b03761c89120393c0c676676496) to fetch and dynamically execute further JavaScript — the EtherHiding technique (MITRE T1102.001, Web Service: Dead Drop Resolver). The attack selectively skips WordPress administrators and logged-in users to reduce detection. The retrieved script renders a fake Google reCAPTCHA (ClickFix) instructing the visitor to open the Windows Run dialog and paste a command (T1204.004), which invokes mshta.exe against http://timelevel12.com/big to retrieve a polyglot MP3/HTA file. A fileless PowerShell stage attempts an AMSI bypass and avoids disk writes, then hands off to an Emmenhtal loader that downloads a further stage from a domain impersonating Bitdefender GravityZone (gpuh.gravityzone.army). That stage extracts x86 shellcode hidden in the pixel data of a steganographic JPEG hosted on the legitimate ibb.co CDN, which is reflectively loaded (T1620) into memory as Amatera Stealer 4.3.3-alpha1. Encrypted telemetry (ECDH P-256) is sent to ultraspeed.pro/collect, and a scheduled task named serviceerg maintains persistence.
Amatera Stealer 4.3.3-alpha1 features updated static obfuscation, syscall-invocation hardening via WoW64 transitions and Heaven's-Gate-style indirect-syscall trampolines to evade user-mode hooks, a redesigned Chrome application-bound-encryption (ABE) bypass inspired by Remus Stealer, and DNS-over-HTTPS resolution of its gw.proxyvector.cc C2 domain to obscure lookups from network monitoring. It harvests browser-stored credentials and other sensitive host data (T1555.003).
The newly reported twist runs on a parallel set of compromised sites carrying fake plugin loaders (rcrsinnovations.com and konverto.in, disguised as ExactMetrics/Contact-Form plugins) that pull an injected loader from cdn.claritydelivr.com/mpackage.js. Rather than resolving payloads from a single Base contract, this variant rotates across at least six BNB Smart Chain testnet (chain ID 97) smart contracts as dead-drop resolvers and stages a secondary C2 check-in at cdn.api-middle-connect.com/metrics. Its most novel element is a covert WebRTC data channel: the malware hand-crafts the WebRTC SDP answer entirely client-side — hardcoding the C2's IP, UDP port, ICE password, and DTLS fingerprint — to open a direct peer-to-peer DTLS/SRTP channel to 103.141.13.26:3479/UDP for command execution, bypassing the normal STUN/TURN signaling-server negotiation and the HTTP(S)-centric inspection most network security tools apply to browser traffic. Independently, Sansec reported a distinct, unrelated Magecart-style WebRTC payment skimmer in the same period using the identical UDP/3479 convention (different C2 IP, 202.181.177.177) to bypass CSP and HTTP-based controls — indicating hand-crafted, signaling-less WebRTC C2 is emerging as convergent tradecraft across separate criminal toolsets rather than a single group's innovation.
The wider Amatera-via-ClickFix ecosystem is also evolving on other fronts: Microsoft and The Hacker News reported a related Python-based loader (WordlistLoader, successor to an earlier Python variant active between late April and mid-June 2026) that encodes shellcode as sequences of plain-English words or 16-byte UUID-encoded chunks before reflectively loading Amatera 4.3.3-alpha1, reflecting rapid, parallel loader iteration around the same stealer family and lure technique.
MITRE ATT&CK techniques used in TL-2026-2311
Defense Evasion
T1027 Obfuscated Files or Information; T1027.003 Steganography; T1036 Masquerading; T1620 Reflective Code Loading
Persistence
Execution
T1059.001 PowerShell; T1204.004 Malicious Copy and Paste
Command and Control
T1071.004 DNS; T1095 Non-Application Layer Protocol; T1102.001 Dead Drop Resolver; T1573 Encrypted Channel
stealth
Credential Access
T1555.003 Credentials from Web Browsers
Resource Development
defense-impairment
Affected products and versions in Malware on the Blockchain
- WordPress — WordPress CMS
Vulnerable versions: any installation compromised via a planted must-use plugin - PrestaShop — PrestaShop CMS
Vulnerable versions: any installation compromised to serve the ClickFix loader - Google — Chrome (browser)
Vulnerable versions: installations with browser-stored credentials targeted via application-bound-encryption bypass - Microsoft — Windows (mshta.exe / PowerShell hosts)
Vulnerable versions: end-user Windows systems executing the ClickFix paste-and-run command
Remediation for Malware on the Blockchain
Immediate actions
- Block/alert at DNS and web proxy on ultraspeed.pro, timelevel12.com, gpuh.gravityzone.army, gw.proxyvector.cc, cdn.claritydelivr.com, cdn.api-middle-connect.com, rcrsinnovations.com, and konverto.in
- Egress-filter and alert on outbound UDP to 103.141.13.26:3479 and on unexpected DTLS/SRTP peer-to-peer sessions established without a corresponding STUN/TURN signaling exchange
- Audit WordPress and PrestaShop installs for unauthorized must-use plugins matching wp-content/mu-plugins/site-helper-*.php and for unexpected Service Worker registrations (nochain-sw.js)
- Hunt for mshta.exe invoked via Win+R clipboard paste with no parent browser download, chained immediately to PowerShell exhibiting AMSI-bypass indicators
- Alert on creation of a scheduled task named serviceerg
Workarounds
- Restrict or disable the Windows Run dialog (Win+R) for standard users via Group Policy to blunt ClickFix paste-and-run lures
- Enforce managed-browser policy (Chrome/Edge Service Worker allowlisting) to prevent malicious Service Worker persistence from compromised sites
Longer-term hardening
- Deploy Attack Surface Reduction / AppLocker rules restricting mshta.exe and blocking script-host execution invoked from a pasted Run-dialog command
- Enforce enterprise browser policy restricting arbitrary Service Worker registration/scope on visited third-party sites
- Implement file-integrity monitoring and WAF coverage on WordPress/PrestaShop admin and plugin directories to catch rogue must-use plugins
- Extend EDR coverage for reflective code loading, WoW64/indirect-syscall evasion, and steganography-based payload staging
- Baseline and alert on endpoint processes making direct calls to blockchain RPC endpoints (Base, BSC) as a dead-drop-resolver C2 indicator
Timeline of Malware on the Blockchain
- Netskope Threat Labs observes the Amatera ClickFix / EtherHiding campaign's compromised-site count trending upward beginning in spring 2026, ultimately reaching 5,400+ compromised WordPress/PrestaShop sites and 2,200+ affected organizations by the September disclosure.
- Microsoft observes a Python-based precursor loader delivering Amatera Stealer via ClickFix, active between late April 2026 and mid-June 2026, ahead of the WordlistLoader evolution.
- The Hacker News reports the WordlistLoader evolution of the ClickFix chain, encoding shellcode as sequences of plain-English words or UUID-encoded chunks before reflectively loading Amatera Stealer 4.3.3-alpha1.
- Digital-forensics community roundup (This Week in 4n6, Week 35) catalogs ongoing multi-vendor EtherHiding/ClickFix reporting as the campaign continues to expand.
- Netskope Threat Labs publishes the companion GitHub IOC repository detailing the Base-mainnet EtherHiding contract, six BSC-testnet dead-drop contracts for the WebRTC variant, and the full multi-stage file/hash chain.
- Netskope Threat Labs discloses the covert WebRTC data-channel C2 variant: a hand-crafted SDP answer opens a peer-to-peer channel to 103.141.13.26:3479/UDP, bypassing the smart-contract EtherHiding resolution used by the primary chain.
Sources cited for Malware on the Blockchain
- Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist
- Netskope Threat Labs IOC repository - Amatera ClickFix
- WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes...
- WordPress Service Worker Uses EtherHiding, ClickFix and Steganography to Deploy Amatera
- Novel WebRTC skimmer bypasses security controls at $100+ billion retailers
- User Execution: Malicious Copy and Paste (T1204.004)
- Web Service: Dead Drop Resolver (T1102.001)
More in malware
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain
- Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation
- ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2
- Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)
- LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique
Detection coverage for TL-2026-2311
As of 2026-09-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2311 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2311
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.