Reported campaign shifts from ClickFix to WebRTC staging across hacked sites
SecurityUnverifiedUpdated:
A campaign reportedly spanning more than 5,400 compromised sites has changed how it stages code. It uses BNB Smart Chain testnet smart contracts for delivery and later replaced ClickFix with a WebRTC stager.
Retrieving the next stage from smart contracts
The report says scripts injected into thousands of compromised websites retrieved next-stage content from smart contracts on the BNB Smart Chain testnet. It says the later variant used a WebRTC data channel to receive and execute code in the browser.
The reported delivery chain initially used a ClickFix lure that prompted visitors to run a PowerShell command.
From ClickFix to WebRTC
The reported campaign later replaced the ClickFix payload held in its smart contract with a WebRTC data-channel stager.
The reported shift suggests attackers can alter the next stage of a campaign through smart-contract-hosted content, while changing the mechanism used to stage code for visitors.
Sources
- BleepingComputerOver 5,400 hacked sites serve ClickFix payloads stored on the blockchainRead source →