5,400 hacked WordPress sites load malware on-chain

Netskope Threat Labs has been tracking a campaign that turned more than 5,400 hacked WordPress sites — plus a share of PrestaShop installs — into a delivery network for malware it does not host. The payload lives in a smart contract on the BNB Smart Chain Testnet. The compromised site only holds a few lines of injected JavaScript that go fetch it. BleepingComputer reported the research on September 5.

The technique is called EtherHiding, and the reason it matters is unglamorous: there is no hosting provider to email.

What actually happened

Each compromised site gets a script that reads its next stage out of a smart contract. Early in the campaign that stage was a ClickFix lure — the fake CAPTCHA that instructs a visitor to paste a PowerShell command into the Run box. Mid-campaign the operators rewrote the contract contents and swapped ClickFix for a WebRTC data-channel stager, which opens an encrypted channel straight to the attacker. Same 5,400 sites. New payload. No redeploy needed, because the sites were never the payload.

Netskope's telemetry has more than 300 infected sites active on any given day. Roughly 400 sites per day reached BSC endpoints during August, peaking at 536. The campaign has been growing since spring 2026.

They used the Testnet on purpose. It is the developers' free sandbox, it behaves like the production chain, and it costs nothing to write to. Free infrastructure with mainnet-grade takedown resistance.

Why it matters for your business

Two things follow, and neither is theoretical.

If you run WordPress or PrestaShop, your marketing site is a plausible node in somebody's delivery network. The injection is small, it does not change how your pages look, and it will not show up in analytics. Check for unexpected scripts in your theme, in wp_options, and in whatever your last unmaintained plugin dropped. Then rotate credentials, because injection means write access.

If you are on the receiving end, the ClickFix pattern is the one to drill into staff: a website never has a legitimate reason to ask a human to paste a command into a terminal or the Windows Run box. Not to prove they are human, not to fix a video, not ever.

And note what actually failed here. The defenders' usual lever — takedown, blocklist the host — does not reach a smart contract. When the attacker's infrastructure cannot be removed, the control that still works is the one on your own machine.

Sources: BleepingComputer, Netskope Threat Labs.