More than 5,400 hacked small business sites serve malware stored on a blockchain

What happened

Netskope's threat research team found the same injected script on more than 5,400 compromised websites. Most of them run on WordPress or PrestaShop, two platforms that carry a large share of small business storefronts. BleepingComputer reported the findings on 5 September 2026 under Bill Toulas' byline, in a piece headlined “Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain”. Netskope set out the campaign's newest stage in its own write-up, “Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist”.

On the visitor side the sequence is short. The hijacked page shows a fake CAPTCHA and asks the user to open the Windows Run box and paste a PowerShell command. In this ClickFix pattern the person who fetches the final payload is the visitor, without realising it. The injected script itself pulls its next stage payload from smart contracts on the BNB Smart Chain testnet. The campaign is still live, with more than 300 infected sites active on any given day.

The details

The technique is called EtherHiding. The malicious instructions live in smart contracts on a blockchain rather than on a server, so the operators can refresh the payload whenever they choose and the infrastructure resists the usual takedown routes. Netskope's telemetry put the daily endpoint contact peak at 536 during August 2026.

The campaign is not standing still either. The operators replaced the original ClickFix payload with a WebRTC data channel stager that opens an encrypted channel and runs the received code inside browser memory, never writing it to disk. The most basic question is still open: BleepingComputer states that ‘The initial compromise method remains unknown.’ No malware family is named anywhere in the reporting. Netskope published the campaign's indicators of compromise in a GitHub repository, and cointrust.com carried the same story on 6 September 2026.

Why it matters

The weight of this goes beyond the individual sites. First, the hosting layer has changed: the malicious code no longer sits at a server address but in a ledger anyone can read and nobody can switch off. Domain suspensions and abuse reports to a hosting provider have little to bite on here. Second, the last link in the chain is persuasion rather than a technical flaw. When the user runs the command on their own machine, with their own hands, the browser's protective layers are simply not in the path. Third, the site owner is a carrier rather than a target, publishing a page that harms its own visitors without knowing it. That assessment is ours.

The payload running without touching disk is a separate problem, because protection built around file scanning has no artefact to inspect. And with the initial compromise method still unknown, defence rests on continuous maintenance rather than on any single patch. That reading is ours.

What it means for businesses in Türkiye

There is nothing specific to Türkiye in the sources. What follows is our reading. Even so, the profile the campaign hits is a familiar one: WordPress and PrestaShop installations built years ago, heavy with plugins, with maintenance that stopped at some point. A large share of small business sites in Türkiye fits that description closely.

The practical steps are concrete. Bring core, themes and plugins to current versions. Do not merely deactivate unused plugins and themes, delete them. Enforce two step verification on administrator accounts and switch on file change logging in your hosting panel. Search your header and footer templates for script tags you do not recognise, and compare what you find with the indicator list Netskope published. Leave your team one rule in a single sentence: no security check will ever ask you to paste a command into the Windows Run box. Finally, a restorable, scheduled backup kept away from the site turns a possible cleanup from days into hours. That assessment is ours.

Sources

Netskope Threat Labs, primary research on the campaign's WebRTC stage · BleepingComputer, ClickFix payloads on more than 5,400 hacked sites · Google News RSS, date and secondary coverage verification