Threat reportMalwareTL-2026-4510
EtherHiding Campaign Evolves: Blockchain-Hosted Payloads on 5,400+ Compromised Sites Add Covert WebRTC Data Channel C2
EtherHiding Campaign Evolves (TL-2026-4510), also tracked as EtherHiding ClickFix campaign, is a high-severity malware campaign, first published 2026-10-27. It has no confirmed attribution, affects WordPress WordPress sites (compromised; initial vector not disclosed), maps to 8 MITRE ATT&CK techniques (T1027, T1059.001, T1059.007), and is covered by 9 detection rules and 5 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 5Indicators of compromise
Key facts for TL-2026-4510
- Threat ID
- TL-2026-4510
- Also known as
- EtherHiding ClickFix campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- small business, ecommerce, retail
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 5
Malware and tooling in EtherHiding Campaign Evolves
Malware and tooling: ClickFix-delivered infostealer (family not named in reviewed sources)
How EtherHiding Campaign Evolves works
Netskope Threat Labs reports an ongoing EtherHiding campaign in which a small injected script on 5,400+ compromised WordPress and PrestaShop sites (2,200+ organizations) reads its next stage from a BNB Smart Chain testnet smart contract and runs it in visitors' browsers. A newer variant swaps the ClickFix fake-CAPTCHA overlay for a WebRTC data-channel stager that hand-writes the SDP answer locally so no real handshake occurs.
Netskope Threat Labs (blog dated 2026-09-04) documents a campaign that has been active since spring 2026 and has grown steadily. Researchers counted more than 5,400 distinct compromised small-business websites across more than 2,200 organizations, with several hundred active on any given day (300+ per weekday). One count showed a peak of 536 sites contacting BSC endpoints in August 2026. Most affected sites run WordPress; some run PrestaShop. The initial compromise vector for the websites is not identified in the public reporting.
Each compromised site carries a small, obfuscated inline JavaScript loader. The loader queries a smart contract on the BNB Smart Chain (BSC) testnet through a public JSON-RPC endpoint (eth_call) and retrieves its next-stage payload. This is the EtherHiding technique: because the payload lives on a public blockchain, there is no delivery domain to seize, and the operator can change the payload for every infected site with a single contract update. Using the testnet makes payload rotation effectively free, since testnet transactions carry no real gas cost. The retrieved JavaScript is assembled in browser memory and executed without writing to disk.
In the original chain, the payload rendered a ClickFix overlay (a fake CAPTCHA) instructing the visitor to open the Windows Run dialog and paste an attacker-supplied PowerShell command, turning the user into the execution mechanism. Later, the actor replaced the contract payload with a WebRTC data-channel stager. The script creates an RTCPeerConnection and a data channel and generates an SDP offer as in a normal handshake. It does not send the offer anywhere. It writes the SDP answer itself and feeds it straight back into the connection, so no signaling handshake occurs but a data channel to the attacker still opens. Reporting says the UDP port, ICE password and DTLS fingerprint are embedded in the stager, and the C2 IP is built from separate numbers so it never appears as a contiguous string. The stager receives JavaScript from the hardcoded C2 address, buffers it in memory and executes it through the DOM, reusing the page's legitimate script nonce. The result is a covert, encrypted channel that resembles peer-to-peer conferencing traffic and bypasses normal signaling visibility.
Source caveat: the public articles reviewed did not disclose contract addresses, C2 IPs, domains or file hashes in their text. Netskope's blog reportedly lists the full BSC-testnet RPC pool and other indicators, but the page body could not be retrieved in full here, so no specific values are recorded. Defender guidance from the sources: block the full BSC-testnet RPC endpoint pool, monitor non-web UDP traffic associated with WebRTC, check CMS file integrity and plugin inventories, restrict the Windows Run dialog, and detect clipboard-to-shell execution. Severity HIGH is an analyst judgment from scale and active status; no vendor severity, CVE or CVSS is stated.
MITRE ATT&CK techniques used in TL-2026-4510
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.004 User Execution: Malicious Copy and Paste
Command and Control
T1095 Non-Application Layer Protocol; T1102.001 Web Service: Dead Drop Resolver; T1573 Encrypted Channel
Initial Access
Affected products and versions in EtherHiding Campaign Evolves
- WordPress — WordPress sites (compromised; initial vector not disclosed)
- PrestaShop — PrestaShop stores (compromised; initial vector not disclosed)
- Microsoft — Windows (visitor endpoints targeted by ClickFix PowerShell lure)
Remediation for EtherHiding Campaign Evolves
Patches
- Keep WordPress core, themes and plugins and PrestaShop modules updated; remove unmaintained plugins (assume unmaintained installs are compromised)
Immediate actions
- Block the full BNB Smart Chain testnet RPC endpoint pool (list published by Netskope) at web proxy/DNS/egress
- Monitor and alert on non-web UDP traffic associated with WebRTC/DTLS from browsers to unfamiliar hosts
- Search web assets for outbound JavaScript references to BSC endpoints and for obfuscated inline loaders
- Hunt for explorer.exe/Run-dialog spawned PowerShell with clipboard-pasted commands
Workarounds
- Blocking the delivery domain is ineffective because delivery is a public blockchain; block the RPC endpoints used to read it instead
- Audit plugin inventories and clean injected loaders from compromised sites
Longer-term hardening
- Restrict the Windows Run dialog via policy and detect clipboard-to-shell execution
- Run file-integrity monitoring on CMS core, theme and plugin files rather than relying on visual inspection
- Block the behavioral pattern (copy-and-run instructions) rather than tracking individual payloads
- Apply browser egress controls or policy limiting WebRTC where it is not business-required
Timeline of EtherHiding Campaign Evolves
- Campaign activity begins and volume starts trending upward during spring 2026 (approximate date; sources give only the season)
- Peak activity in August 2026, with 536 websites observed contacting BSC testnet endpoints (approximate date; sources give only the month)
- Netskope Threat Labs publishes research (per search summaries) documenting 5,400+ compromised sites across 2,200+ organizations and the shift from the ClickFix payload to a WebRTC data-channel stager
- Security-news mirror (hendryadrian.com) republishes the Netskope research, listing eth_call JSON-RPC retrieval and the embedded UDP port, ICE password and DTLS fingerprint in the WebRTC stager
- Netskope recommends blocking the full BSC-testnet RPC endpoint pool and monitoring non-web UDP traffic tied to WebRTC, and points defenders to its NetskopeThreatLabsIOCs GitHub repository for the endpoint list
- Netskope blog 'Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist' dated 2026-09-04; 300+ compromised sites observed per weekday
- BleepingComputer (Bill Toulas) reports 5,400+ hacked sites serving ClickFix payloads stored on the blockchain, ~300-400 infected sites active daily with a peak of 536 in August; follow-on coverage by breached.company, gblock.app and EdgeX News
Sources cited for EtherHiding Campaign Evolves
- Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist (Netskope Threat Labs)
- Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain (BleepingComputer)
- Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist (mirror, hendryadrian.com)
- ClickFix EtherHiding BNB Smart Chain 5,400 hacked sites (breached.company)
- Cybercriminals Conceal ClickFix Payloads in BNB Smart Chain Smart Contracts (EdgeX News)
- ClickFix EtherHiding BNB chain 5,400 sites (gblock.app)
- Potential EtherHiding C2 via Curl JSON-RPC Request (Elastic detection rule)
- Netskope Threat Labs IOCs repository
Detection coverage for TL-2026-4510
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4510 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.