# Malware on the Blockchain: EtherHiding/Amatera ClickFix Campaign Adds a Covert WebRTC C2 Channel

> Netskope Threat Labs documents an evolving, financially motivated campaign that compromises WordPress and PrestaShop sites to run ClickFix/fake-reCAPTCHA lures resolving payloads from a mutable blockchain smart contract (EtherHiding), ending in the Amatera credential stealer. A newly disclosed variant abandons the smart-contract lookup for a covert, hand-crafted WebRTC data channel to reach its C2 directly over UDP.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2311
- **ID:** TL-2026-2311
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Netskope Threat Labs tracks an active, growing malware-distribution campaign that abuses compromised WordPress and PrestaShop websites as a delivery front for the Amatera password stealer (aka ACR Stealer / AcridRain Stealer). As of the September 3, 2026 disclosure, Netskope counted 5,400+ compromised websites and 2,200+ affected organizations worldwide, with roughly 300 sites actively serving the payload per day and the count trending upward since spring 2026.

In the primary infection chain, attackers plant a rogue WordPress must-use plugin (named in the pattern site-helper-<hex>) that auto-loads with the site and registers a malicious Service Worker (nochain-sw.js) in visiting browsers. The Service Worker intercepts page requests, strips the site's Content-Security-Policy header, and injects a Base64-encoded loader that calls a mutable smart contract on the Base blockchain (0x58460d0b3d4d6b03761c89120393c0c676676496) to fetch and dynamically execute further JavaScript — the EtherHiding technique (MITRE T1102.001, Web Service: Dead Drop Resolver). The attack selectively skips WordPress administrators and logged-in users to reduce detection. The retrieved script renders a fake Google reCAPTCHA (ClickFix) instructing the visitor to open the Windows Run dialog and paste a command (T1204.004), which invokes mshta.exe against http://timelevel12.com/big to retrieve a polyglot MP3/HTA file. A fileless PowerShell stage attempts an AMSI bypass and avoids disk writes, then hands off to an Emmenhtal loader that downloads a further stage from a domain impersonating Bitdefender GravityZone (gpuh.gravityzone.army). That stage extracts x86 shellcode hidden in the pixel data of a steganographic JPEG hosted on the legitimate ibb.co CDN, which is reflectively loaded (T1620) into memory as Amatera Stealer 4.3.3-alpha1. Encrypted telemetry (ECDH P-256) is sent to ultraspeed.pro/collect, and a scheduled task named serviceerg maintains persistence.

Amatera Stealer 4.3.3-alpha1 features updated static obfuscation, syscall-invocation hardening via WoW64 transitions and Heaven's-Gate-style indirect-syscall trampolines to evade user-mode hooks, a redesigned Chrome application-bound-encryption (ABE) bypass inspired by Remus Stealer, and DNS-over-HTTPS resolution of its gw.proxyvector.cc C2 domain to obscure lookups from network monitoring. It harvests browser-stored credentials and other sensitive host data (T1555.003).

The newly reported twist runs on a parallel set of compromised sites carrying fake plugin loaders (rcrsinnovations.com and konverto.in, disguised as ExactMetrics/Contact-Form plugins) that pull an injected loader from cdn.claritydelivr.com/mpackage.js. Rather than resolving payloads from a single Base contract, this variant rotates across at least six BNB Smart Chain testnet (chain ID 97) smart contracts as dead-drop resolvers and stages a secondary C2 check-in at cdn.api-middle-connect.com/metrics. Its most novel element is a covert WebRTC data channel: the malware hand-crafts the WebRTC SDP answer entirely client-side — hardcoding the C2's IP, UDP port, ICE password, and DTLS fingerprint — to open a direct peer-to-peer DTLS/SRTP channel to 103.141.13.26:3479/UDP for command execution, bypassing the normal STUN/TURN signaling-server negotiation and the HTTP(S)-centric inspection most network security tools apply to browser traffic. Independently, Sansec reported a distinct, unrelated Magecart-style WebRTC payment skimmer in the same period using the identical UDP/3479 convention (different C2 IP, 202.181.177.177) to bypass CSP and HTTP-based controls — indicating hand-crafted, signaling-less WebRTC C2 is emerging as convergent tradecraft across separate criminal toolsets rather than a single group's innovation.

The wider Amatera-via-ClickFix ecosystem is also evolving on other fronts: Microsoft and The Hacker News reported a related Python-based loader (WordlistLoader, successor to an earlier Python variant active between late April and mid-June 2026) that encodes shellcode as sequences of plain-English words or 16-byte UUID-encoded chunks before reflectively loading Amatera 4.3.3-alpha1, reflecting rapid, parallel loader iteration around the same stealer family and lure technique.

## MITRE ATT&CK

- T1584.006 Web Services
- T1204.004 Malicious Copy and Paste
- T1218.005 Mshta
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1620 Reflective Code Loading
- T1102.001 Dead Drop Resolver
- T1095 Non-Application Layer Protocol
- T1573 Encrypted Channel
- T1071.004 DNS
- T1555.003 Credentials from Web Browsers

## Sources

- [Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist](https://www.netskope.com/blog/malware-on-the-blockchain-an-ongoing-campaigns-new-webrtc-twist)
- [Netskope Threat Labs IOC repository - Amatera ClickFix](https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Malware/Amatera%20ClickFix)
- [WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes...](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html)
- [WordPress Service Worker Uses EtherHiding, ClickFix and Steganography to Deploy Amatera](https://cyberpress.org/wordpress-etherhiding-deploys-amatera/)
- [Novel WebRTC skimmer bypasses security controls at $100+ billion retailers](https://sansec.io/research/webrtc-skimmer)
- [User Execution: Malicious Copy and Paste (T1204.004)](https://attack.mitre.org/techniques/T1204/004/)
- [Web Service: Dead Drop Resolver (T1102.001)](https://attack.mitre.org/techniques/T1102/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2311