Threat Overview
Netskope Threat Labs reported an EtherHiding campaign using more than 5,400 compromised websites across more than 2,200 organizations to retrieve attacker-controlled payloads from BNB Smart Chain testnet smart contracts. Most examined sites were WordPress, with some PrestaShop. The injected loader performs a JSON-RPC eth_call to the BSC testnet, retrieves a second-stage script, and executes it in the visitor browser. One branch presents a fake CAPTCHA that instructs the victim to open the Windows Run dialog and paste a command that downloads and executes the final payload. A newer branch replaces ClickFix with a covert WebRTC data-channel stager that can receive and execute JavaScript while avoiding a normal signaling exchange.
References
- Netskope Threat Labs, September 3, 2026: https://www.netskope.com/fr/blog/malware-on-the-blockchain-an-ongoing-campaigns-new-webrtc-twist
- BleepingComputer coverage, September 5, 2026: https://www.bleepingcomputer.com/
Impacted Systems
Targets: visitors to compromised small-business websites and the compromised site owners themselves. Site platforms observed most often: WordPress and PrestaShop. Endpoint exposure: Windows users who follow the ClickFix instructions and execute the pasted command; browser users may also be exposed to the WebRTC stager. Infrastructure: BNB Smart Chain testnet JSON-RPC endpoints and attacker-controlled smart contracts. The initial website compromise method is not confirmed.
Why this matters
The campaign is broad, active, and resilient to takedown because the operator can update payloads through a smart contract. The WebRTC variant also reduces visibility through traditional HTTP inspection.
Criticality: High
Exploitation Status
Confirmed active campaign. Netskope counted more than 5,400 compromised sites and several hundred active on a typical day, with activity trending upward.
What this hunt looks for
Available Microsoft Sentinel telemetry can be reviewed for ClickFix-like PowerShell execution, browser-to-script-interpreter chains, BNB/BSC testnet RPC access, PowerShell network activity, MSHTA/remote script execution, unusual non-HTTP browser traffic, and web/CMS compromise indicators where the relevant data is ingested.
Required logs
- Microsoft Defender XDR / Defender for Endpoint tables: DeviceProcessEvents and DeviceNetworkEvents
- DNS telemetry in DnsEvents for DNS-layer hunting
- Firewall, proxy, or WAF telemetry normalized to CommonSecurityLog for web/CMS hunting
First Pass – ClickFix Run Dialog and PowerShell Pattern
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe")
| where ProcessCommandLine has_any ("-enc", "-encodedcommand", "iex", "Invoke-Expression", "DownloadString", "Invoke-WebRequest", "iwr ", "curl ", "mshta")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descBrowser Followed by Script Interpreter
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by TimeGenerated descBNB Smart Chain Testnet RPC Access
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any ("bsc", "binance", "bnb")
| where RemoteUrl has_any ("testnet", "dataseed", "rpc")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated descDNS Queries for BNB Testnet Infrastructure
DnsEvents
| where TimeGenerated > ago(14d)
| where Name has_any ("bsc", "binance", "bnb") and Name has_any ("testnet", "dataseed", "rpc")
| project TimeGenerated, Computer, ClientIP, Name, IPAddresses
| order by TimeGenerated descPowerShell Network Activity After Interactive Execution
let P = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| project DeviceId, ProcessId, PTime=TimeGenerated, DeviceName, AccountName, ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe")
| join kind=inner P on DeviceId
| where TimeGenerated between (PTime .. PTime + 10m)
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated descMSHTA or Script Execution With Remote Content
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("mshta.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("http://", "https://", "javascript:", "vbscript:")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated descRare Non-HTTP Browser Network Activity
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe")
| where RemotePort !in (80,443)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Ports=make_set(RemotePort,20) by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| order by Connections ascPotential CMS Compromise Indicators in Web Logs
CommonSecurityLog
| where TimeGenerated > ago(14d)
| extend Raw=strcat(RequestURL," ",RequestMethod," ",Message," ",AdditionalExtensions)
| where Raw has_any ("wp-content", "wp-admin", "wp-includes", "prestashop", "modules/")
| where RequestMethod in~ ("POST", "PUT") or Raw has_any ("plugin", "upload", "eval(", "base64_decode")
| project TimeGenerated, SourceIP, DestinationIP, RequestMethod, RequestURL, DeviceAction, Message
| order by TimeGenerated descDetection Notes
Highest signal: BSC testnet RPC access from endpoints without legitimate blockchain use, browser-adjacent PowerShell/MSHTA execution, and PowerShell making network connections immediately after interactive execution. WebRTC data channels may not appear in HTTP proxy logs, so endpoint/network telemetry is important. The initial compromise mechanism for the websites is unknown, so do not attribute generic WordPress compromise solely to this campaign.
Killian Sherer 