# EtherHiding Campaign Evolves: Blockchain-Hosted Payloads on 5,400+ Compromised Sites Add Covert WebRTC Data Channel C2

> Netskope Threat Labs reports an ongoing EtherHiding campaign in which a small injected script on 5,400+ compromised WordPress and PrestaShop sites (2,200+ organizations) reads its next stage from a BNB Smart Chain testnet smart contract and runs it in visitors' browsers. A newer variant swaps the ClickFix fake-CAPTCHA overlay for a WebRTC data-channel stager that hand-writes the SDP answer locally so no real handshake occurs.

- **Published:** 2026-10-27T04:42:45Z
- **Last reviewed:** 2026-10-27T04:42:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4510
- **ID:** TL-2026-4510
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Netskope Threat Labs (blog dated 2026-09-04) documents a campaign that has been active since spring 2026 and has grown steadily. Researchers counted more than 5,400 distinct compromised small-business websites across more than 2,200 organizations, with several hundred active on any given day (300+ per weekday). One count showed a peak of 536 sites contacting BSC endpoints in August 2026. Most affected sites run WordPress; some run PrestaShop. The initial compromise vector for the websites is not identified in the public reporting.

Each compromised site carries a small, obfuscated inline JavaScript loader. The loader queries a smart contract on the BNB Smart Chain (BSC) testnet through a public JSON-RPC endpoint (eth_call) and retrieves its next-stage payload. This is the EtherHiding technique: because the payload lives on a public blockchain, there is no delivery domain to seize, and the operator can change the payload for every infected site with a single contract update. Using the testnet makes payload rotation effectively free, since testnet transactions carry no real gas cost. The retrieved JavaScript is assembled in browser memory and executed without writing to disk.

In the original chain, the payload rendered a ClickFix overlay (a fake CAPTCHA) instructing the visitor to open the Windows Run dialog and paste an attacker-supplied PowerShell command, turning the user into the execution mechanism. Later, the actor replaced the contract payload with a WebRTC data-channel stager. The script creates an RTCPeerConnection and a data channel and generates an SDP offer as in a normal handshake. It does not send the offer anywhere. It writes the SDP answer itself and feeds it straight back into the connection, so no signaling handshake occurs but a data channel to the attacker still opens. Reporting says the UDP port, ICE password and DTLS fingerprint are embedded in the stager, and the C2 IP is built from separate numbers so it never appears as a contiguous string. The stager receives JavaScript from the hardcoded C2 address, buffers it in memory and executes it through the DOM, reusing the page's legitimate script nonce. The result is a covert, encrypted channel that resembles peer-to-peer conferencing traffic and bypasses normal signaling visibility.

Source caveat: the public articles reviewed did not disclose contract addresses, C2 IPs, domains or file hashes in their text. Netskope's blog reportedly lists the full BSC-testnet RPC pool and other indicators, but the page body could not be retrieved in full here, so no specific values are recorded. Defender guidance from the sources: block the full BSC-testnet RPC endpoint pool, monitor non-web UDP traffic associated with WebRTC, check CMS file integrity and plugin inventories, restrict the Windows Run dialog, and detect clipboard-to-shell execution. Severity HIGH is an analyst judgment from scale and active status; no vendor severity, CVE or CVSS is stated.

## MITRE ATT&CK

- T1204.004 User Execution: Malicious Copy and Paste
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1027 Obfuscated Files or Information
- T1095 Non-Application Layer Protocol
- T1573 Encrypted Channel
- T1102.001 Web Service: Dead Drop Resolver
- T1659 Content Injection

## Sources

- [Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist (Netskope Threat Labs)](https://www.netskope.com/blog/malware-on-the-blockchain-an-ongoing-campaigns-new-webrtc-twist)
- [Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain (BleepingComputer)](https://bleepingcomputer.com/news/security/over-5-400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain)
- [Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist (mirror, hendryadrian.com)](https://www.hendryadrian.com/?p=111946)
- [ClickFix EtherHiding BNB Smart Chain 5,400 hacked sites (breached.company)](https://breached.company/clickfix-etherhiding-bnb-smart-chain-5400-hacked-sites-2026/)
- [Cybercriminals Conceal ClickFix Payloads in BNB Smart Chain Smart Contracts (EdgeX News)](https://pro.edgex.exchange/en-US/news/article/clickfix-malware-bnb-smart-chain)
- [ClickFix EtherHiding BNB chain 5,400 sites (gblock.app)](https://www.gblock.app/articles/clickfix-etherhiding-bnb-chain-5400-sites-2026)
- [Potential EtherHiding C2 via Curl JSON-RPC Request (Elastic detection rule)](https://detection.fyi/elastic/detection-rules/macos/command_and_control_etherhiding_c2_via_blockchain_rpc_request/)
- [Netskope Threat Labs IOCs repository](https://github.com/netskopeoss/NetskopeThreatLabsIOCs)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4510